Don't let auth redirects set redirectUri

0xsend · Jul 19, 2024 · 3887845 · 3887845
1 parent 00dbe0b
commit 3887845
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/apps/next/utils/userProtected.ts b/apps/next/utils/userProtected.ts
@@ -28,9 +28,11 @@ export function userProtectedGetSSP<
 
     if (!session) {
       log('no session')
-      const destination = ctx.req.url
-        ? `/auth/sign-in?redirectUri=${encodeURIComponent(ctx.req.url)}`
-        : '/auth/sign-in'
+      const destination =
+        ctx.req.url === undefined || ctx.req.url.includes('/auth')
+          ? '/auth/sign-in'
+          : `/auth/sign-in?redirectUri=${encodeURIComponent(ctx.req.url)}`
+
       return {
         redirect: {
           destination,