From 3608fca48c90678e6f9ffd4b92fb35dbc7b4c560 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=B4me=20Chilliet?= <come.chilliet@nextcloud.com>
Date: Tue, 21 Apr 2026 17:07:15 +0200
Subject: [PATCH] fix: Always redirect to an absolute URL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
---
 core/src/components/login/PasswordLessLoginForm.vue | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/core/src/components/login/PasswordLessLoginForm.vue b/core/src/components/login/PasswordLessLoginForm.vue
index f6966222a60..94fccb1df8a 100644
--- a/core/src/components/login/PasswordLessLoginForm.vue
+++ b/core/src/components/login/PasswordLessLoginForm.vue
@@ -45,6 +45,7 @@
 
 <script type="ts">
 import { browserSupportsWebAuthn } from '@simplewebauthn/browser'
+import { getBaseUrl } from '@nextcloud/router'
 import { defineComponent } from 'vue'
 import {
 	NoValidCredentials,
@@ -130,9 +131,15 @@ export default defineComponent({
 
 			return finishAuthentication(challenge)
 				.then(({ defaultRedirectUrl }) => {
-					console.debug('Logged in redirecting')
-					// Redirect url might be false so || should be used instead of ??.
-					window.location.href = redirectUrl || defaultRedirectUrl
+					logger.debug('Logged in redirecting')
+					if (redirectUrl) {
+						if (redirectUrl.charAt(0) !== "/") {
+							redirectUrl = "/" + redirectUrl;
+						}
+						window.location.href = getBaseUrl() + redirectUrl
+					} else {
+						window.location.href = defaultRedirectUrl
+					}
 				})
 				.catch(error => {
 					console.debug('GOT AN ERROR WHILE SUBMITTING CHALLENGE!')