# NO_ASSIGN_WINDOW_LOCATION

Direct assignments to "window.location.href" or "window.location" should be avoided due to possible XSS attacks that can occur from lack
of sanitization of input to the "href".

## How to fix

The recommended approach for Next.js applications is to use a custom `redirectTo` function. This provides a clear way to use `router.push()`
or `window.location.href` to provide an experience that is best for the user (client-side navigation only, or a full page refresh).
Here's an example of how you might do this using Next.js:

Before:

```js filename="my-site.js"
windows.location.href = '/login';
```

After:

```js filename="my-site.js"
router.push('/login');
```


--------------------------------------------------------------------------------
title: "NO_CORS_HEADERS"
description: "Warns when CORS header (or header-like) configuration is detected, requiring that configuration to be allowlisted."
last_updated: "2026-02-03T02:58:39.262Z"
source: "https://vercel.com/docs/conformance/rules/NO_CORS_HEADERS"
--------------------------------------------------------------------------------