Redirect after login loses query params

techAPJ · June 27, 2019, 2:23pm

Looking at:

app/controllers/static_controller.rb

863d8014d


      
            elsif redirect_location.present? && !redirect_location.match(login_path)
              begin
                forum_uri = URI(Discourse.base_url)
                uri = URI(redirect_location)
          
                if uri.path.present? &&
                   (uri.host.blank? || uri.host == forum_uri.host) &&
                   uri.path !~ /\./
          
                  destination = uri.path
                  destination = "#{uri.path}?#{uri.query}" if uri.path =~ /new-topic/ || uri.path =~ /new-message/ || uri.path =~ /user-api-key/
                end
              rescue URI::Error
                # Do nothing if the URI is invalid
              end
            end
          
            redirect_to destination
          end
          
          FAVICON ||= -"favicon"

It seems like we preserve query params for a few pre-defined paths and this pattern started with this commit (not sure why I did that… ).

@sam should we start supporting query params for all the paths? I don’t see any security implication by allowing query params on random path.

Topic		Replies	Views
Does discourse has return_path or return_link I can leverage to redirect to previous link after log in complete? Product Support login	2	156	August 22, 2026
GTM parameters are not preserved, or passed to GTM Product Support	3	404	May 9, 2024
Users not redirected to original page upon successful login Product Support	2	214	August 14, 2025
Url to pass back after SSO to redirect back to previous url/topic SSO	0	1621	January 31, 2017
Redirect after login one like logout redirect Feature	6	6455	January 10, 2015

Redirect after login loses query params

Related topics