Blog: the gate's sign-in link carries the path only (#115)

OP OpenVibers committed 15 days ago · 6e3c175a9d · 1 file, +1 −1

The 401 page put the whole requested URL, query and all, into the sign-in link, so an anonymous
response could echo words from a gated page's query string. The link now returns to the path.

Changes

ddiff --git a/server/http/editor.js b/server/http/editor.js
iindex 95c4f83..cdeeb50 100644
---- a/server/http/editor.js
++++ b/server/http/editor.js
@@@ -47,7 +47,7 @@ function createEditorRoutes(ctx) {
              // A gated page answers on this origin, noindex, instead of bouncing to sign-in: a crawler
              // that followed the redirect read openvibe.network's canonical as this page's. The page
              // links to sign-in, so a person is one click from where the redirect used to take them.
--            if (req.method === 'GET') return publicRoutes.messagePage(req, res, 401, 'Sign in to write', 'The editor is for OpenVibe accounts. Sign in and you come straight back here.', { href: `/auth/login?next=${encodeURIComponent(req.originalUrl)}`, label: 'Sign in with OpenVibe' });
++            if (req.method === 'GET') return publicRoutes.messagePage(req, res, 401, 'Sign in to write', 'The editor is for OpenVibe accounts. Sign in and you come straight back here.', { href: `/auth/login?next=${encodeURIComponent(req.path)}`, label: 'Sign in with OpenVibe' });
              return publicRoutes.messagePage(req, res, 401, 'Sign in first', 'Your session ended. Sign in and try again.', { href: `/auth/login?next=${encodeURIComponent('/write')}`, label: 'Sign in' });
          }
          if (!req.viewer.subject) return publicRoutes.messagePage(req, res, 403, 'Account not ready', 'Your OpenVibe sign-in did not include an account id. Sign out and in again.');

diff --git a/server/http/editor.js b/server/http/editor.js

index 95c4f83..cdeeb50 100644

--- a/server/http/editor.js

+++ b/server/http/editor.js

@@ -47,7 +47,7 @@ function createEditorRoutes(ctx) {

// A gated page answers on this origin, noindex, instead of bouncing to sign-in: a crawler

// that followed the redirect read openvibe.network's canonical as this page's. The page

// links to sign-in, so a person is one click from where the redirect used to take them.

- if (req.method === 'GET') return publicRoutes.messagePage(req, res, 401, 'Sign in to write', 'The editor is for OpenVibe accounts. Sign in and you come straight back here.', { href: `/auth/login?next=${encodeURIComponent(req.originalUrl)}`, label: 'Sign in with OpenVibe' });

+ if (req.method === 'GET') return publicRoutes.messagePage(req, res, 401, 'Sign in to write', 'The editor is for OpenVibe accounts. Sign in and you come straight back here.', { href: `/auth/login?next=${encodeURIComponent(req.path)}`, label: 'Sign in with OpenVibe' });

return publicRoutes.messagePage(req, res, 401, 'Sign in first', 'Your session ended. Sign in and try again.', { href: `/auth/login?next=${encodeURIComponent('/write')}`, label: 'Sign in' });

}

if (!req.viewer.subject) return publicRoutes.messagePage(req, res, 403, 'Account not ready', 'Your OpenVibe sign-in did not include an account id. Sign out and in again.');