auth fix?

2026-07-11 13:11:45 -07:00
parent e67f6b073c
commit ec334bbed4
6 changed files with 32 additions and 15 deletions
@@ -29,9 +29,16 @@ function RouteComponent() {
          const urlParams = new URLSearchParams(window.location.search);
          const redirect = urlParams.get('redirect');

-          if (redirect && !redirect.includes('_serverFn') && !redirect.includes('/api/')) {
+          const safe =
+            redirect &&
+            redirect.startsWith('/') &&
+            !redirect.startsWith('/refresh-session') &&
+            !redirect.includes('_serverFn') &&
+            !redirect.includes('/api/');
+
+          if (safe) {
            logger.info("Refresh session route: redirecting to", redirect);
-            window.location.href = decodeURIComponent(redirect);
+            window.location.href = redirect;
          } else {
            logger.info("Refresh session route: redirecting to home");
            window.location.href = '/';