theta42/proxy
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

logInRedirect: keep the query string on the legacy /login/<path> form

Browse Source 
The OIDC provider sends an unauthenticated authorize request through
/login/oauth/authorize?client_id=…&state=…; dropping the query there
loses the whole authorization request. The ?redirect= form is unaffected.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
William Mantly
2026-07-25 23:55:08 -04:00
parent a83a5fd39a
commit fcc09d1e4b
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nodejs/public/lib/js/app-base.js
+4 -2
View File
@@ -379,11 +379,13 @@ app.auth = (function(app){
} }
// Where to go after a successful login: the ?redirect= query param, or the // Where to go after a successful login: the ?redirect= query param, or the
// legacy /login/<path> suffix form, constrained to a same-origin path. // legacy /login/<path> suffix form, constrained to a same-origin path. The
// suffix form keeps its query string — /login/oauth/authorize?client_id=…
// is how the OIDC provider sends an unauthenticated user through login.
function logInRedirect(){ function logInRedirect(){
var params = new URLSearchParams(location.search); var params = new URLSearchParams(location.search);
var target = params.get('redirect') var target = params.get('redirect')
|| location.href.replace(location.origin + '/login', '').split('?')[0] || location.href.replace(location.origin + '/login', '')
|| '/'; || '/';
window.location.href = safeInternalPath(target); window.location.href = safeInternalPath(target);
} }