diff --git a/app/login/controllers/login-controller.js b/app/login/controllers/login-controller.js
index 7867a0c..350429b 100644
--- a/app/login/controllers/login-controller.js
+++ b/app/login/controllers/login-controller.js
@@ -40,7 +40,9 @@
             if (status) {
               $scope.$emit('user-logged-in', {});
               var next = $location.search().next;
-              if (next === undefined || next == null) {
+              // don't allow forwarding to non-local urls
+              if (next === undefined || next == null ||
+                  next.indexOf('//') >= 0) {
                 $window.location.hash = '#/overview/server';
               } else {
                 $window.location.href = next;