# [CRUCIBLE-SEED]
# category: open_redirect
# severity: high
# language: ruby
# expected: redirect_to params[:url] without validation — open redirect

class SessionsController < ApplicationController
  def create
    if authenticated?
      redirect_to params[:url] || root_path
    else
      flash[:error] = 'Invalid credentials'
      render :new
    end
  end
end