fix: infinite redirect loop between web and dashboard apps

[NehanAhmed]

Three interacting failures causing an infinite redirect loop with exponentially nested redirectTo parameters:

1. Navbar Dashboard button linked to APP_URL (port 5173) instead of DASHBOARD_URL (port 5174) — fixed to use DASHBOARD_URL from config

2. All redirect validation functions (getSafeRedirect/getRedirectTo/ isSafeRedirectPath) only checked startsWith('/') and !startsWith('//') but accepted auth pages like /login, /signup, /forgot-password, /reset-password, /auth/callback — added an AUTH_PATHS blocklist that rejects these as redirect targets

3. Nesting of redirectTo query params caused encoding amplification on each hop — added query string stripping when a redirect target contains its own ?redirectTo= param

Additionally, added a WEB_LOGIN_URL guard in the dashboard that detects when VITE_APP_URL resolves to the dashboard's own origin (port 5174) instead of the web app (port 5173), preventing self-referencing navigation that causes an infinite page reload.

Summary by CodeRabbit

• New Features

  • Added safer sign-in and sign-up redirection between the web app and dashboard.
  • Added automatic session handoff to the dashboard after authentication.
  • Added a Sign Out action for authenticated users.
  • Dashboard links now open the configured dashboard destination.

• Bug Fixes

  • Prevented unsafe or chained redirect URLs.
  • Improved authentication callback handling and fallback navigation.
  • Preserved intended destinations while avoiding authentication-route loops.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6a029ca2-c9c7-4dcd-a7dc-928f30d4a3a5

📥 Commits

Reviewing files that changed from the base of the PR and between 25faf11 and 9ee4e27.

📒 Files selected for processing (6)

• apps/dashboard/src/hooks/use-auth.tsx
• apps/dashboard/src/pages/AuthCallback.tsx
• apps/web/src/components/auth/AuthRouteGuard.tsx
• apps/web/src/components/landing/Navbar.tsx
• apps/web/src/hooks/use-auth.tsx
• apps/web/src/pages/AuthCallback.tsx

---

📝 Walkthrough

Walkthrough

Authentication redirects now validate redirectTo values, relay Supabase tokens from the web app to the dashboard callback, complete callback navigation, and provide dashboard and sign-out controls in the landing navbar.

Changes

Authentication redirect flow

Layer / File(s)	Summary
Web redirect sanitization and session relay apps/web/src/hooks/use-auth.tsx	Redirect targets are sanitized, explicit sessions are relayed to the dashboard, and sign-in/sign-up relays require valid session data and redirect targets.
Web-to-dashboard auth handoff apps/web/src/components/auth/AuthRouteGuard.tsx	The route guard validates redirectTo, retrieves the Supabase session, and redirects to the dashboard callback with encoded tokens.
Dashboard login routing and callback completion apps/dashboard/src/hooks/use-auth.tsx, apps/dashboard/src/pages/AuthCallback.tsx	Dashboard login redirects use the external web login URL, while callbacks validate tokens and redirect targets before full-page navigation.
Web callback redirect validation apps/web/src/pages/AuthCallback.tsx	The web callback sanitizes its redirectTo parameter before downstream navigation.
Authenticated navigation controls apps/web/src/components/landing/Navbar.tsx	Authenticated desktop and mobile navigation uses DASHBOARD_URL and provides Supabase sign-out actions.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant AuthRouteGuard
  participant Supabase
  participant DashboardAuthCallback
  AuthRouteGuard->>Supabase: Fetch current session
  Supabase-->>AuthRouteGuard: Return access and refresh tokens
  AuthRouteGuard->>DashboardAuthCallback: Redirect with tokens and sanitized redirectTo
  DashboardAuthCallback->>Supabase: Set session
  DashboardAuthCallback->>User: Navigate to sanitized redirect path

Loading

Possibly related PRs

• NehanAhmed/linkify#23: Both changes modify AuthRouteGuard authenticated-user redirect behavior.
• NehanAhmed/linkify#25: Both changes modify web auth redirects and query/path handling.
• NehanAhmed/linkify#26: This change builds on the dashboard auth hook and provider scaffolding.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/infinite-redirect-loop

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}