Address undesirable URLs being considered for back redirection #4302

New Issue

OVERLORD · 2026-02-05T08:29:23+03:00

OVERLORD commented

2026-02-05 08:29:23 +03:00

Originally created by @ssddanbrown on GitHub (Nov 7, 2023).

This is a specific problem in scenarios where the Referrer header is not present (browser settings or via Referrer-Policy header).
The app falls back to previous URL tracked in the session, but this may not reflect an actual user page.
An example of this is secure images. Also relevant is #4649.
This leads to users being redirected to odd endpoints in such scenarios.

We could potentially override session or redirect handling to not track undesireable URLs.
Alternatively, we could avoid using the in-built back redirection within BookStack for an alternative option. As an example, we could provide the redirect path within the request (some care to be taken here to prevent open redirection).

Potentially revert the changes in ea0469e61a once done to allow PWA manifest personalisation.

Originally created by @ssddanbrown on GitHub (Nov 7, 2023). This is a specific problem in scenarios where the `Referrer` header is not present (browser settings or via `Referrer-Policy` header). The app falls back to previous URL tracked in the session, but this may not reflect an actual user page. An example of this is secure images. Also relevant is #4649. This leads to users being redirected to odd endpoints in such scenarios. We could potentially override session or redirect handling to not track undesireable URLs. Alternatively, we could avoid using the in-built back redirection within BookStack for an alternative option. As an example, we could provide the redirect path within the request (some care to be taken here to prevent open redirection). Potentially revert the changes in ea0469e61ae20be5020cae6aadab678fb2bde8bd once done to allow PWA manifest personalisation.

OVERLORD added the 🔧 Maintenance 🐛 Bug 🏭 Back-End labels 2026-02-05 08:29:23 +03:00

OVERLORD closed this issue

2026-02-05 08:29:29 +03:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#4302