diff --git a/admin/tool/mobile/autologin.php b/admin/tool/mobile/autologin.php
index 13154b3d3ef..ffc0e899c5a 100644
--- a/admin/tool/mobile/autologin.php
+++ b/admin/tool/mobile/autologin.php
@@ -27,7 +27,8 @@ require_once($CFG->libdir . '/externallib.php');
 
 $userid = required_param('userid', PARAM_INT);  // The user id the key belongs to (for double-checking).
 $key = required_param('key', PARAM_ALPHANUMEXT);    // The key generated by the tool_mobile_external::get_autologin_key() external function.
-$urltogo = optional_param('urltogo', $CFG->wwwroot, PARAM_URL);    // URL to redirect.
+$urltogo = optional_param('urltogo', $CFG->wwwroot, PARAM_LOCALURL);    // URL to redirect.
+$urltogo = $urltogo ?: $CFG->wwwroot;
 
 $context = context_system::instance();
 $PAGE->set_context($context);