I am getting fortify critical issues whenever window.location.href. An example of how this is being used is window.location.href = pathname + queryParams.

The pathname is set in based on a session storage var and query params are based on the language that is set by the user. Is this a large security issue?

The issues I am receiving are Open Redirect and Cross-Site Scripting: DOM

I know in the case of "Open Redirect" issues, it is detecting that you are redirecting to a URL that is made up of data passed to or created in your JavaScript. I'm just trying to figure out if the only way do it server side?