The resource auth page copies the redirect query parameter into
redirectUrl when its host matches the resource host
(src/app/auth/resource/[resourceGuid]/page.tsx:121-150). URL parses a
host out of every scheme that uses "//", so a target such as
javascript://resource-host/... passes that comparison. The value is
handed to ResourceAuthPortal as the redirect prop and assigned to
window.location.href after a successful login
(src/components/ResourceAuthPortal.tsx:213,247,281).
Parse the target once and require http: or https: before the host
comparisons. The three branches that assigned the same value are folded
into one condition; the accepted set of http(s) targets is unchanged.
Resolve conflicts against upstream's refactors:
- server/db/sqlite/schema/schema.ts: adopt upstream's reindented
sqliteTable(name, cols, indexes) form for sites/resources, re-applying
the headers -> requestHeaders/responseHeaders split. Kept in sync with
the Postgres schema.
- server/lib/traefik/headersMiddleware.ts: extend upstream's extracted
buildCustomHeadersMiddleware helper to take requestHeaders and
responseHeaders and emit both customRequestHeaders and
customResponseHeaders.
- server/lib/traefik/getTraefikConfig.ts and
server/private/lib/traefik/getTraefikConfig.ts: keep upstream's helper
extraction and appendPathMatch refactor, dropping the superseded inline
blocks.
Also carry the feature forward onto code that moved upstream:
- The resource settings UI moved from resources/proxy/[niceId]/proxy to
resources/public/[niceId]/http, which dropped this branch's changes in
the previous merge. Re-add the request/response header inputs there and
rename the vestigial headers field on the tcp page.
- messages/da-DK.json is new upstream and still had the old customHeaders
key; rename it in line with the other locales.
Per the contributing docs, versioned migrations are intentionally omitted
so maintainers can write them at release time.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Jan Kahmen