dkam/clinch
1
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

Add a method to remove parameters from urls, so we can redirect without risk of infinite redirect. Fix a bunch of redirects to login afer being foced to log out. Add missing migrations

Browse Source
This commit is contained in:
Dan Milne
2026-01-05 13:01:32 +11:00
parent 524a7719c3
commit 95d0d844e9
7 changed files with 42 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
app/controllers/sessions_controller.rb
View File

@@ -86,17 +86,8 @@ class SessionsController < ApplicationController
end
# Sign in successful (password only)
# Preserve the return_to_after_authenticating value across session boundary
# (e.g., when max_age flow destroys the session and creates a temporary one)
preserved_return_url = session[:return_to_after_authenticating]
start_new_session_for user, acr: "1"
# Restore the return URL if it was lost during session recreation
if preserved_return_url.present? && session[:return_to_after_authenticating].blank?
session[:return_to_after_authenticating] = preserved_return_url
end
# Use status: :see_other to ensure browser makes a GET request
# This prevents Turbo from converting it to a TURBO_STREAM request
redirect_to after_authentication_url, notice: "Signed in successfully.", allow_other_host: true, status: :see_other
@@ -134,12 +125,7 @@ class SessionsController < ApplicationController
if session[:totp_redirect_url].present?
session[:return_to_after_authenticating] = session.delete(:totp_redirect_url)
end
# Preserve return URL across session boundary for max_age flow
preserved_return_url = session[:return_to_after_authenticating]
start_new_session_for user, acr: "2"
if preserved_return_url.present? && session[:return_to_after_authenticating].blank?
session[:return_to_after_authenticating] = preserved_return_url
end
redirect_to after_authentication_url, notice: "Signed in successfully.", allow_other_host: true
return
end
@@ -151,12 +137,7 @@ class SessionsController < ApplicationController
if session[:totp_redirect_url].present?
session[:return_to_after_authenticating] = session.delete(:totp_redirect_url)
end
# Preserve return URL across session boundary for max_age flow
preserved_return_url = session[:return_to_after_authenticating]
start_new_session_for user, acr: "2"
if preserved_return_url.present? && session[:return_to_after_authenticating].blank?
session[:return_to_after_authenticating] = preserved_return_url
end
redirect_to after_authentication_url, notice: "Signed in successfully using backup code.", allow_other_host: true
return
end