From b36da152a3d08ea87004da752f05f4128eac5fc0 Mon Sep 17 00:00:00 2001 From: m4 Date: Sat, 8 Aug 2026 10:25:33 +0800 Subject: [PATCH] fix(webui): don't redirect on change-password 401 (wrong input, not expired session) Co-Authored-By: Claude Opus 4.7 --- src/lib/authRedirect.test.ts | 4 ++++ src/lib/authRedirect.ts | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/src/lib/authRedirect.test.ts b/src/lib/authRedirect.test.ts index 50b61fa..7b81f18 100644 --- a/src/lib/authRedirect.test.ts +++ b/src/lib/authRedirect.test.ts @@ -24,6 +24,10 @@ describe("shouldRedirectFor", () => { expect(shouldRedirectFor("/api/auth/login", 401, "/")).toBe(false); }); + it("ignores the change-password endpoint (401 means wrong input, not expired session)", () => { + expect(shouldRedirectFor("/api/auth/password", 401, "/")).toBe(false); + }); + it("ignores 401 while already on the login page", () => { expect(shouldRedirectFor("/api/auth/me", 401, "/login")).toBe(false); }); diff --git a/src/lib/authRedirect.ts b/src/lib/authRedirect.ts index a1f03e5..b1080bc 100644 --- a/src/lib/authRedirect.ts +++ b/src/lib/authRedirect.ts @@ -12,7 +12,9 @@ export function shouldRedirectFor( return false; } if (!path.startsWith("/api/")) return false; - if (path === "/api/auth/login") return false; + // /api/auth/password 401 means "wrong current password" (form error), + // not an expired session — redirecting would log the user out mid-session. + if (path === "/api/auth/login" || path === "/api/auth/password") return false; return true; }