From 1aa9fcd31d53ad3e9d81125f08fc3ebee2b3d01e Mon Sep 17 00:00:00 2001 From: Pavel Artsishevsky Date: Tue, 11 Aug 2026 22:33:05 +0200 Subject: [PATCH] Fixes redirect-based OAuth login when `OAUTH_DISABLE_POPUP=true` is set (#2171) Switch to localStorage, which is shared across all tabs/windows of the same origin. Also clean up the stored entry and strip the callback URL on both success and failure paths. --- internal/site/src/components/login/auth-form.tsx | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/internal/site/src/components/login/auth-form.tsx b/internal/site/src/components/login/auth-form.tsx index eab87576..1a1a08dc 100644 --- a/internal/site/src/components/login/auth-form.tsx +++ b/internal/site/src/components/login/auth-form.tsx @@ -175,8 +175,8 @@ export function UserAuthForm({ */ function redirectToOauthProvider(provider: AuthProviderInfo) { const url = new URL(provider.authURL) - // url.searchParams.set("redirect_uri", `${window.location.origin}${basePath}`) - sessionStorage.setItem("provider", JSON.stringify(provider)) + url.searchParams.set("redirect_uri", `${window.location.origin}${basePath}`) + localStorage.setItem("provider", JSON.stringify(provider)) window.location.href = url.toString() } @@ -186,12 +186,13 @@ export function UserAuthForm({ const code = params.get("code") if (code) { const state = params.get("state") - const provider: AuthProviderInfo = JSON.parse(sessionStorage.getItem("provider") ?? "{}") + const provider: AuthProviderInfo = JSON.parse(localStorage.getItem("provider") ?? "{}") + localStorage.removeItem("provider") + window.history.replaceState({}, "", window.location.pathname) if (!state || provider.state !== state) { showLoginFaliedToast() } else { setIsOauthLoading(true) - window.history.replaceState({}, "", window.location.pathname) pb.collection("users") .authWithOAuth2Code(provider.name, code, provider.codeVerifier, `${window.location.origin}${basePath}`) .then(() => $authenticated.set(pb.authStore.isValid))