v1.2.23Web App
•1 min read

Post-Login Origin Page Redirect & Deep Link Preservation

Web AppAuthenticationCLI ConnectMCP AuthorizeSecurity

Added full origin URL preservation and return redirection across all authentication methods (Credentials, TOTP, Passkeys, Passkey MFA, Google OAuth) and protected layouts.

#Deep-Link Preservation & Post-Login Redirection

When navigating to protected resources (such as Settings tabs, CLI connect sessions, MCP consent dialogues, or documentation pages) while unauthenticated or expired, ApiVault now securely retains your requested page destination and returns you straight back upon successful login.

  • All Login Methods Supported: Preserves and routes to the originating callbackUrl across standard email/password credentials, two-factor TOTP verification, passwordless Passkey login, Passkey MFA challenges, and Google OAuth SSO.
  • Middleware & Server Layouts: Added server-side path tracking via Next.js middleware and secure headers in DashboardLayout and SettingsLayout to preserve deep-linked URLs during session expiry.
  • Open-Redirect Protection: Built strict callback sanitization to validate relative paths and prevent external or scheme-relative open-redirect vulnerabilities.
  • Registration & Onboarding Continuity: New users signing up or completing initial 2FA onboarding automatically continue directly to their requested workflow or CLI/MCP authorization prompt.