fix(ui): preserve post-login redirect target through oauth2-proxy sign-in - #2532
Open
onematchfox wants to merge 2 commits into
Open
fix(ui): preserve post-login redirect target through oauth2-proxy sign-in#2532onematchfox wants to merge 2 commits into
oauth2-proxy sign-in#2532onematchfox wants to merge 2 commits into
Conversation
…n-in When oauth2-proxy intercepts an unauthenticated request it serves its sign-in page carrying the original destination as `.Redirect` (e.g. `/oauth2/sign_in?rd=%2Fagents%2Ffoo`). `sign_in.html` template ignored that and unconditionally redirected to `/login`, and `/login`'s "Sign in with SSO" link was hardcoded to `rd=/` -- so any login, expired- cookie or not, always landed back on the home page instead of the page the user was trying to reach. Signed-off-by: Brian Fox <878612+onematchfox@users.noreply.github.com>
onematchfox
changed the title
oauth2-proxy sign-in
github-actions
Bot
added
bug
Adds env var to `oauth2-proxy`'s `Deployment` to ensure that it rolls out when content is updated. The vendored chart's `Deployment` doesn't support a checksum/config-style pod annotation for extra mounted ConfigMaps. Signed-off-by: Brian Fox <878612+onematchfox@users.noreply.github.com>
onematchfox
force-pushed
the
fix-preserve-login-url
branch
from
August 24, 2026 11:15
8cfcd0e to
27fdd5f
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes lost post-auth navigation by preserving the original destination (rd) across the oauth2-proxy sign-in flow and the UI’s /login page, so users land back on the page they initially requested (instead of always returning to /).
Changes:
- Added a
sanitizeRedirecthelper (with Jest tests) to prevent open-redirect stylerdvalues and ensure only safe same-origin paths are forwarded. - Updated the
/loginpage to readrdfrom query params, sanitize it, and pass it through to the “Sign in with SSO” link. - Updated the Helm oauth2-proxy sign-in template to forward oauth2-proxy’s
.Redirectinto/login?rd=..., and added a values-driven checksum env var intended to force a rollout when the template content changes.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| ui/src/lib/loginRedirect.ts | Adds redirect-target sanitization logic to safely preserve post-login destinations. |
| ui/src/lib/tests/loginRedirect.test.ts | Covers sanitizer behavior for safe paths and common open-redirect vectors. |
| ui/src/app/login/page.tsx | Threads sanitized rd through the SSO start link so login returns users to their original page. |
| helm/kagent/values.yaml | Adds an env var intended to change on template updates to trigger oauth2-proxy redeploys. |
| helm/kagent/templates/oauth2-proxy-templates.yaml | Switches ConfigMap body to a named helper template to support hashing and reuse. |
| helm/kagent/templates/_helpers.tpl | Defines the oauth2-proxy sign_in.html body that forwards .Redirect to /login?rd=.... |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
jjamroga
reviewed
Aug 26, 2026
| # Forces a rollout whenever the sign_in.html ConfigMap's content changes. | ||
| - name: KAGENT_OAUTH2_PROXY_SIGNIN_TEMPLATE_CHECKSUM | ||
| value: '{{ include "kagent.oauth2ProxySignInHTML" . | sha256sum }}' | ||
|
|
Collaborator
There was a problem hiding this comment.
I think this is duplicated? extraEnv is also defined here. We should move this to the existing block
https://github.com/kagent-dev/kagent/pull/2532/changes#diff-3b5f638fea13e3428d305315de39c1cca6bf917d0a9c20b4a0d5364537b2c1f9R985-R994
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When oauth2-proxy intercepts an unauthenticated request it serves its sign-in page carrying the original destination as
.Redirect(e.g./oauth2/sign_in?rd=%2Fagents%2Ffoo).sign_in.htmltemplate ignored that and unconditionally redirected to/login, and/login's "Sign in with SSO" link was hardcoded tord=/-- so any login, expired- cookie or not, always landed back on the home page instead of the page the user was trying to reach.Also contains a Helm update that ensures that this change will result in
oauth2-proxybeing redeployed to pick up the updated sign-in page template.