feat(web): redirect authenticated users away from login page #2928
Conversation
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
✅ Deploy Preview for howto-fix-macos-audio-selection canceled.
|
✅ Deploy Preview for hyprnote ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for hyprnote-storybook ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
| throw redirect({ | ||
| to: search.redirect || "/app/account", | ||
| }); |
There was a problem hiding this comment.
Open Redirect Vulnerability: The search.redirect parameter is user-controlled and used directly as a redirect destination without validation. An attacker can craft a malicious URL like /auth?flow=web&redirect=https://evil.com to redirect authenticated users to external sites for phishing attacks.
Fix: Validate that the redirect is a relative path:
if (user && search.flow === "web") {
const redirectTo = search.redirect || "/app/account";
// Ensure redirect is relative and doesn't start with // or http(s)://
if (redirectTo.startsWith('http://') || redirectTo.startsWith('https://') || redirectTo.startsWith('//')) {
throw redirect({ to: "/app/account" });
}
throw redirect({ to: redirectTo });
}| throw redirect({ | |
| to: search.redirect || "/app/account", | |
| }); | |
| throw redirect({ | |
| to: search.redirect && !search.redirect.startsWith('http://') && | |
| !search.redirect.startsWith('https://') && !search.redirect.startsWith('//') | |
| ? search.redirect | |
| : "/app/account", | |
| }); |
Spotted by Graphite Agent
Is this helpful? React 👍 or 👎 to let us know.
Summary
When a user with an active auth session visits the
/auth(login) page withflow=web, they are now automatically redirected away from the login page. The redirect destination is either theredirectsearch param if provided, or/app/accountby default.This mirrors the inverse logic in
/_view/app/route.tsxwhich redirects unauthenticated users TO/auth.Desktop flow (
flow=desktop) is intentionally unaffected to allow the desktop app OAuth handshake to complete.Security
The redirect parameter is validated to prevent open redirect attacks. URLs starting with
http://,https://, or//are rejected and fall back to/app/account.Review & Testing Checklist for Human
/auth?flow=webwhile logged in - should redirect to/app/account/auth?flow=web&redirect=/pricingwhile logged in - should redirect to/pricing/auth?flow=web&redirect=https://evil.comwhile logged in - should redirect to/app/account(NOT evil.com)/auth?flow=web&redirect=//evil.comwhile logged in - should redirect to/app/account/auth?flow=desktopwhile logged in - should NOT redirect (allows OAuth to complete)/authwhile logged out - should show login page normallyNotes
Requested by @ComputelessComputer
Link to Devin run