lizhimins commented on PR #5336: URL: https://github.com/apache/rocketmq-dashboard/pull/5336#issuecomment-6413399215
Thank you for this — the session-expiry redirect landed first through #7311 (merged into `rocketmq-studio` as `5e6c8971e`), so this PR is now a duplicate of the part that shipped: - `web/src/api/client.ts` builds `/login?redirect=<path+query>` when a session turns out unauthorized, with the self-reference guard for an expiry while already on `/login`; - `web/src/pages/login/index.tsx` honours it through a `sanitizeReturnPath` helper that rejects protocol-relative URLs (`//evil.com`), anything with a scheme, and backslashes. Closing on that basis, not because the analysis was wrong — #5245 is closed as resolved by #7311. One case in your branch is **not** covered by what landed, and it is worth keeping: the `AuthGate` in `web/src/App.tsx` still does `<Navigate to="/login" replace />` when the gate denies, which drops the page exactly the way the old `client.ts` did. That path is not an axios 401, so the client-side helper never runs. If you would like to follow up, a slim PR with just the `AuthGate` change — your `sessionExpiryRedirectUrl(location.pathname, location.search)` idea — plus its test would be welcome, and we will review it on its own merits. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
