diff --git a/src/routes/api/export-integrations/[provider]/+server.ts b/src/routes/api/export-integrations/[provider]/+server.ts
index 5afeeee..a0a9e93 100644
--- a/src/routes/api/export-integrations/[provider]/+server.ts
+++ b/src/routes/api/export-integrations/[provider]/+server.ts
@@ -18,10 +18,21 @@ export const PUT = async (event: RequestEvent) => {
 			await event.locals.supabase.auth.setSession(session);
 		}
 
-		const body = (await event.request.json()) as {
+		let body: {
 			folderId?: string | null;
 			path?: string | null;
 		};
+		try {
+			body = (await event.request.json()) as {
+				folderId?: string | null;
+				path?: string | null;
+			};
+		} catch (err) {
+			if (err instanceof SyntaxError) {
+				return new Response('Malformed JSON', { status: 400 });
+			}
+			throw err;
+		}
 
 		const patch: Record<string, unknown> = {};
 		if (body.folderId !== undefined) patch.folderId = body.folderId;
diff --git a/src/routes/api/integrations/dropbox/connect/+server.ts b/src/routes/api/integrations/dropbox/connect/+server.ts
index 904fbb6..2b0f7e8 100644
--- a/src/routes/api/integrations/dropbox/connect/+server.ts
+++ b/src/routes/api/integrations/dropbox/connect/+server.ts
@@ -13,7 +13,9 @@ export const GET = async (event: RequestEvent) => {
 	const path = url.searchParams.get('path');
 	const returnToRaw = url.searchParams.get('returnTo');
 	const returnTo =
-		returnToRaw && returnToRaw.startsWith('/') ? returnToRaw : '/backup-settings';
+		returnToRaw && returnToRaw.startsWith('/') && !returnToRaw.startsWith('//')
+			? returnToRaw
+			: '/backup-settings';
 
 	if (pokedexId) {
 		const { session } = await event.locals.safeGetSession();
diff --git a/src/routes/api/integrations/google-drive/connect/+server.ts b/src/routes/api/integrations/google-drive/connect/+server.ts
index 2098752..0ba80d6 100644
--- a/src/routes/api/integrations/google-drive/connect/+server.ts
+++ b/src/routes/api/integrations/google-drive/connect/+server.ts
@@ -13,7 +13,9 @@ export const GET = async (event: RequestEvent) => {
 	const folderId = url.searchParams.get('folderId');
 	const returnToRaw = url.searchParams.get('returnTo');
 	const returnTo =
-		returnToRaw && returnToRaw.startsWith('/') ? returnToRaw : '/backup-settings';
+		returnToRaw && returnToRaw.startsWith('/') && !returnToRaw.startsWith('//')
+			? returnToRaw
+			: '/backup-settings';
 
 	if (pokedexId) {
 		const { session } = await event.locals.safeGetSession();