Redirect back to the originating page after sign-in, not always /

Sign in link now carries ?redirect=<question_id>; /auth/login stashes it in the session (validated same-site-path-only to avoid an open redirect via a crafted query param), /auth/callback reads it back for the final redirect instead of a hardcoded "/".
2026-08-05 14:40:44 +02:00
parent d5bbe799ce
commit 3242482c8e
2 changed files with 36 additions and 5 deletions
@@ -138,7 +138,11 @@ fn QuestionView(
                            .into_any()
                    } else {
                        view! {
-                            <a class="alt-submit" href="/auth/login" rel="external">
+                            <a
+                                class="alt-submit"
+                                href=format!("/auth/login?redirect={question_id}")
+                                rel="external"
+                            >
                                "Sign in"
                            </a>
                        }