Skip to content

fix(auth): Keep login redirect in browser history#118614

Closed
scttcper wants to merge 1 commit into
masterfrom
scttcper/auth-login-redirect
Closed

fix(auth): Keep login redirect in browser history#118614
scttcper wants to merge 1 commit into
masterfrom
scttcper/auth-login-redirect

Conversation

@scttcper

@scttcper scttcper commented Jun 26, 2026

Copy link
Copy Markdown
Member

in SPA mode (mostly local dev) do not replace history with /auth/login/ and allow users to get back to where they were

The SPA 401 handler was replacing the current history entry when sending users to login. Let it push the login route instead so back navigation can return to the page that hit auth.

Co-Authored-By: Codex <noreply@openai.com>
@github-actions github-actions Bot added the Scope: Frontend Automatically applied to PRs that change frontend components label Jun 26, 2026
@scttcper scttcper requested a review from a team June 26, 2026 23:59
@scttcper scttcper marked this pull request as ready for review June 26, 2026 23:59

@cursor cursor Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 85063ab. Configure here.

Comment thread static/app/api.tsx

if (EXPERIMENTAL_SPA) {
apiNavigate?.('/auth/login/', {replace: true});
apiNavigate?.('/auth/login/');

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Parallel 401s duplicate login entries

Medium Severity

Removing {replace: true} from the SPA login redirect means every in-flight 401 runs this handler while the URL is still the protected page. Each call uses a history push to /auth/login/, so one expired session can stack many login entries and make the back button unusable in local SPA mode.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 85063ab. Configure here.

@scttcper scttcper closed this Jun 27, 2026
@scttcper scttcper deleted the scttcper/auth-login-redirect branch June 27, 2026 00:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Scope: Frontend Automatically applied to PRs that change frontend components

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant