redirection is set on client. can it be protected so redirection comes from the server side ?

[danielbenedykt]

I am using blueauth in a project and it was pointed out that redirection can be changed by injecting js or in the client, so after login redirection can be manipulated. is there a way to protect against that or that the redirect url comes from the server ?