Conversation
A logged-out user opening a dashboard link was bounced to /signin and then dropped on the environment home, losing the destination the link carried. PrivateRoute now puts the current location on the bounce as ?next=, which Signin already forwards as returnTo. The 1024 cap moves from the signin request schema into safeReturnTo, so an over-long destination resolves to / instead of failing the request and blocking login outright.
Contributor
Preview Deploys
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 6 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
The length check reads plainly on its own, and why the cap moved out of the request schema belongs in the commit that moved it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Open a dashboard link while logged out — say
app.nango.dev/team/billing— and you get sent to the login page. Log in and you land on the dashboard home page instead of the page the link pointed at, so you navigate there yourself.Session cookies last 7 days, and people open emailed links days after they arrive. The session is usually gone by then, so this is the normal case rather than a rare one. It came up with the invite link in the join-request email.
The server side already worked, MFA step included. Nothing recorded where you were headed.
Changes
PrivateRoutesends a logged-out user to the login page, it now adds the page they asked for as?next=. The login page already passes that on asreturnTo.safeReturnTo, so a longer destination falls back to/instead of failing the request and blocking login. The Logs page can put enough filters in the URL to go over it.Fixes NAN-6573
Testing
On the preview, logged out, open
/team/billingor/dev/logs?states=failed. Log in and you should land on that URL, query string included. Open/logged out and you get a plain/signinwith nonext.Nothing to screenshot; only where you end up changes.
Follow-ups