code: function saveReturnUrlToSession(req, isReturnUrlAllowed) {
    const referrer = req.get("referrer")
    const isInternalRequest = Boolean(
      referrer && url.parse(referrer).hostname === req.hostname
    )
  
    const isUrlAllowed = isReturnUrlAllowed(req.originalUrl)
    const isSessionSet = Boolean(req.session && req.session.returnTo)
  
    if (!isUrlAllowed || isInternalRequest || isSessionSet) {
      return
    }
  
    req.session.returnTo = req.originalUrl
  }
docs: Browser might try to fetch assets already before the "main request" reaches our server. We must tell apart these locations from where the user really tries to go. Also, we should set returnTo only once per session.