---
title: "Verify recovery returns only to an allowed application destination"
description: "Exercise a reset link with the application supported return destination and a controlled unapproved destination to verify redirect policy after recovery."
canonical_url: "https://vostride.com/agent-library/account-recovery/recovery-link-redirect-safety.md"
md_url: "https://vostride.com/agent-library/account-recovery/recovery-link-redirect-safety.md"
content_kind: "recipe"
topic: "account-recovery"
---

# Verify recovery returns only to an allowed application destination

Exercise a reset link with the application supported return destination and a controlled unapproved destination to verify redirect policy after recovery.

## Risk

Recovery links sometimes carry a return destination. The application should preserve permitted navigation while enforcing its documented destination allowlist; a successful password change must not silently send the user to an unapproved page.

## Fixtures

- A disposable account, test inbox, and an allowed internal account-settings return path.
- A controlled harmless external test destination outside the application allowlist, with no credential collection.
- A documented redirect contract and a supported fixture or link builder for setting the return destination.

## Steps

1. Generate a recovery request using the supported allowed return path and obtain its run-specific link from the test inbox.
2. Complete the reset and verify the final page is the allowed account-settings destination or its documented sign-in gate.
3. In a fresh recovery request, use the supported fixture to specify the controlled unapproved destination.
4. Complete or reject that flow according to the product contract and verify the browser never reaches the unapproved destination.
5. Inspect the application recovery record and verify the credential outcome matches the visible result; confirm the user has a usable route to sign in.

## Expected results

- Allowed internal return navigation follows the documented recovery contract.
- An unapproved destination is rejected or replaced with the documented safe fallback.
- The password state remains consistent with whether the recovery operation completed.

## False-pass traps

- The destination test is meaningful only when the fixture actually sets the application recognized return parameter.
- Merely checking the reset form origin misses a redirect that occurs after successful submission.

## Cleanup

- Restore the fixture account password and invalidate any outstanding recovery links.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Account recovery QA recipes](/agent-library/account-recovery.md)
- [Software factory QA library](/agent-library.md)