From 19c7ac919469518c99593298e61543dfa5175b79 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=B4me=20Chilliet?= <come.chilliet@nextcloud.com>
Date: Tue, 21 Apr 2026 17:07:15 +0200
Subject: [PATCH] fix: Always redirect to an absolute URL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
---
 core/src/components/login/PasswordLessLoginForm.vue | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/core/src/components/login/PasswordLessLoginForm.vue b/core/src/components/login/PasswordLessLoginForm.vue
index 194dc3f9c23..a29d4be1f8e 100644
--- a/core/src/components/login/PasswordLessLoginForm.vue
+++ b/core/src/components/login/PasswordLessLoginForm.vue
@@ -52,6 +52,7 @@
 
 <script type="ts">
 import { browserSupportsWebAuthn } from '@simplewebauthn/browser'
+import { getBaseUrl } from '@nextcloud/router'
 import { defineComponent } from 'vue'
 import NcEmptyContent from '@nextcloud/vue/components/NcEmptyContent'
 import NcTextField from '@nextcloud/vue/components/NcTextField'
@@ -147,8 +148,15 @@ export default defineComponent({
 
 			return finishAuthentication(challenge)
 				.then(({ defaultRedirectUrl }) => {
-					logger.debug('Logged in redirecting') // Redirect url might be false so || should be used instead of ??.
-					window.location.href = redirectUrl || defaultRedirectUrl
+					logger.debug('Logged in redirecting')
+					if (redirectUrl) {
+						if (redirectUrl.charAt(0) !== "/") {
+							redirectUrl = "/" + redirectUrl;
+						}
+						window.location.href = getBaseUrl() + redirectUrl
+					} else {
+						window.location.href = defaultRedirectUrl
+					}
 				})
 				.catch((error) => {
 					logger.debug('GOT AN ERROR WHILE SUBMITTING CHALLENGE!', { error }) // Example: timeout, interaction refused...