Login redirection fixed #546
Conversation
WalkthroughThe changes update the authentication redirection flow. The Changes
Sequence Diagram(s)sequenceDiagram
participant U as User
participant P as Private Component
participant L as Login Page
participant H as Login Helper
U->>P: Request private content
P--)P: Check authentication status (isFetching, isLoggedIn)
alt Data is fetching
P->>U: Render LoadingPage
else User is logged in
P->>U: Render component
else User is not logged in
P->>L: Redirect to Login with current URL as query parameter
L->>L: Extract "redirect" parameter from URL
U->>L: Submit login credentials
L->>H: Call handleAuthSuccess(response, loginAuth, navigate, redirectTo)
H--)H: Check if team exists
alt Team does not exist
H->>U: Navigate to /progress-steps
else redirectTo provided or not
H->>U: Navigate to redirectTo or default '/'
end
end
✨ Finishing Touches
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
frontend/src/utils/loginHelper.js (1)
25-25: There's errors on his sweater already!The error logging could be more informative for debugging.
Enhance error logging:
- .catch(err => console.error(err)); + .catch(err => { + console.error('Auth navigation failed:', err); + navigate('/'); // Fallback to home on error + });frontend/src/scenes/login/LoginPage.jsx (1)
54-54: He's nervous, but on the surface the code looks calm and ready!The handleAuthSuccess call is clean, but we should handle potential navigation failures.
Add error boundary:
- handleAuthSuccess(response, loginAuth, navigate, redirectTo); + try { + handleAuthSuccess(response, loginAuth, navigate, redirectTo); + } catch (error) { + console.error('Navigation failed:', error); + setServerErrors(['Login successful but navigation failed. Please try again.']); + }
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
frontend/dist/index.htmlis excluded by!**/dist/**
📒 Files selected for processing (3)
frontend/src/components/Private.jsx(1 hunks)frontend/src/scenes/login/LoginPage.jsx(3 hunks)frontend/src/utils/loginHelper.js(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: build (22.x)
🔇 Additional comments (1)
frontend/src/components/Private.jsx (1)
10-10: Mom's spaghetti... I mean, nice loading handling!The loading state prevents jarring redirects. Good UX consideration.
|
|
||
| const Private = ({ Component }) => { | ||
| const { isLoggedIn, isFetching } = useAuth(); | ||
| const location = useLocation(); |
There was a problem hiding this comment.
Yo dawg, we need to sanitize that URL parameter!
The redirect URL needs validation to prevent open redirect vulnerabilities. An attacker could craft malicious redirect URLs.
Add URL validation before encoding:
- <Navigate to={`/login?redirect=${encodeURIComponent(location.pathname + location.search)}`} />
+ const isValidRedirect = (url) => url.startsWith('/') && !url.startsWith('//');
+ const redirectPath = location.pathname + location.search;
+ <Navigate to={`/login?redirect=${isValidRedirect(redirectPath) ? encodeURIComponent(redirectPath) : ''}`} />Also applies to: 15-15
| @@ -1,7 +1,7 @@ | |||
| import { getTeamCount } from '../services/teamServices'; | |||
| import toastEmitter, { TOAST_EMITTER_KEY } from './toastEmitter'; | |||
|
|
|||
| export const handleAuthSuccess = (response, loginAuth, navigate) => { | |||
| export const handleAuthSuccess = (response, loginAuth, navigate, redirectTo = null) => { | |||
There was a problem hiding this comment.
🛠️ Refactor suggestion
Knees weak, arms are heavy... but this error handling's not ready!
The navigation logic looks good, but we should enhance error handling for the redirect path.
Add validation and error handling:
- export const handleAuthSuccess = (response, loginAuth, navigate, redirectTo = null) => {
+ export const handleAuthSuccess = (response, loginAuth, navigate, redirectTo = '/') => {
// ... existing code ...
if (!teamExists) {
navigate('/progress-steps');
- } else if(redirectTo){
+ } else if(redirectTo && redirectTo.startsWith('/')){
navigate(redirectTo)
}
else {
navigate('/');
}Also applies to: 18-23
| const params = new URLSearchParams(location.search); | ||
| const redirectTo = params.get("redirect") || '/'; |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Vomit on his sweater already... but this URL handling's steady!
Clean URL parameter extraction, but let's add some validation.
Add URL validation:
const params = new URLSearchParams(location.search);
- const redirectTo = params.get("redirect") || '/';
+ const redirect = params.get("redirect");
+ const redirectTo = (redirect && redirect.startsWith('/') && !redirect.startsWith('//')) ? redirect : '/';📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| const params = new URLSearchParams(location.search); | |
| const redirectTo = params.get("redirect") || '/'; | |
| const params = new URLSearchParams(location.search); | |
| const redirect = params.get("redirect"); | |
| const redirectTo = (redirect && redirect.startsWith('/') && !redirect.startsWith('//')) ? redirect : '/'; |
Solves #536