fa/breadcrumb-the-shire
1
0
Fork 1
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(session): preserve intended URL across session timeout with remember-me

Browse Source 
Session timeout redirected to /de/login?return_to=... but the remember-me
cookie was not cleared by logoutDueToSessionTimeout(). On the next request,
autoLoginFromCookie() silently re-logged the user in, causing the MintyPHP
router to resolve the login route to pages/index().php (dashboard) instead
of the login action — the intended URL redirect logic never executed.

Fix: intercept ?return_to= immediately after successful auto-login in
index.php and redirect to the sanitized route path. Also harden the login
flow with hidden return_to form fields and POST body fallback for cases
without remember-me.

Additional improvements in this commit:
- Convert stored REQUEST_URI to router-compatible path (strip leading
  slash and locale prefix) via IntendedUrlService::toRoutePath()
- Consolidate duplicate CSRF data attributes into shared data-csrf-key
  and data-csrf-token on <html> element
- Add tenant branding (logo) to auth pages via appAuthLogoUrl() helper

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Felix Schneider
2026-03-13 18:28:13 +01:00
parent add5cca222
commit e1c211069e
10 changed files with 115 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
web/index.php
View File

@@ -53,7 +53,20 @@ if ($defaultLocale !== null) {
// Auto-login from remember-me cookie
if (empty($_SESSION['user']['id'])) {
$rememberMeService->autoLoginFromCookie();
$autoLoginResult = $rememberMeService->autoLoginFromCookie();
if ($autoLoginResult) {
// After auto-login (e.g. session timeout with active remember-me cookie),
// honour ?return_to= so the user lands on the page they were on.
$returnToParam = trim((string) ($_GET['return_to'] ?? ''));
if ($returnToParam !== '') {
$intendedUrlService = app(IntendedUrlService::class);
$sanitized = $intendedUrlService->sanitize($returnToParam);
if ($sanitized !== '') {
$routePath = $intendedUrlService->toRoutePath($sanitized);
Router::redirect($routePath);
}
}
}
}
// Session timeout enforcement (idle + absolute)

4
web/js/components/app-session-warning.js
View File

@@ -29,8 +29,8 @@ const readConfig = () => {
const pingUrl = root.dataset.sessionPingUrl || '';
const logoutUrl = root.dataset.sessionLogoutUrl || '';
const csrfKey = root.dataset.sessionCsrfKey || '';
const csrfToken = root.dataset.sessionCsrfToken || '';
const csrfKey = root.dataset.csrfKey || '';
const csrfToken = root.dataset.csrfToken || '';
if (!pingUrl || !logoutUrl || !csrfKey || !csrfToken) {
return null;

4
web/js/core/app-telemetry.js
View File

@@ -244,8 +244,8 @@ const resolveConfig = () => {
return {
enabled,
endpoint: normalizeWhitespace(root.dataset.telemetryUrl || ''),
csrfKey: normalizeWhitespace(root.dataset.telemetryCsrfKey || ''),
csrfToken: normalizeWhitespace(root.dataset.telemetryCsrfToken || ''),
csrfKey: normalizeWhitespace(root.dataset.csrfKey || ''),
csrfToken: normalizeWhitespace(root.dataset.csrfToken || ''),
sampleRate: clampRate(root.dataset.telemetrySampleRate || DEFAULT_SAMPLE_RATE, DEFAULT_SAMPLE_RATE),
maxEventsPerMinute: clampPositiveInt(
root.dataset.telemetryMaxEventsPerMinute || DEFAULT_MAX_EVENTS_PER_MINUTE,