From 4a0d4369cdecbeba379455aa9277500c12dabbbf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=B4me=20Chilliet?= <come.chilliet@nextcloud.com>
Date: Tue, 21 Apr 2026 17:07:15 +0200
Subject: [PATCH] fix: Always redirect to an absolute URL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
---
 core/src/components/login/PasswordLessLoginForm.vue | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/core/src/components/login/PasswordLessLoginForm.vue b/core/src/components/login/PasswordLessLoginForm.vue
index 04db5cef05a..817d9805e38 100644
--- a/core/src/components/login/PasswordLessLoginForm.vue
+++ b/core/src/components/login/PasswordLessLoginForm.vue
@@ -42,6 +42,7 @@
 
 <script>
 import { browserSupportsWebAuthn } from '@simplewebauthn/browser'
+import { getBaseUrl } from '@nextcloud/router'
 import {
 	startAuthentication,
 	finishAuthentication,
@@ -125,9 +126,15 @@ export default {
 
 			return finishAuthentication(challenge)
 				.then(({ defaultRedirectUrl }) => {
-					console.debug('Logged in redirecting')
-					// Redirect url might be false so || should be used instead of ??.
-					window.location.href = redirectUrl || defaultRedirectUrl
+					logger.debug('Logged in redirecting')
+					if (redirectUrl) {
+						if (redirectUrl.charAt(0) !== "/") {
+							redirectUrl = "/" + redirectUrl;
+						}
+						window.location.href = getBaseUrl() + redirectUrl
+					} else {
+						window.location.href = defaultRedirectUrl
+					}
 				})
 				.catch(error => {
 					console.debug('GOT AN ERROR WHILE SUBMITTING CHALLENGE!')