heartcombo / devise

Flexible authentication solution for Rails with Warden.
http://blog.plataformatec.com.br/tag/devise/
MIT License
23.89k stars 5.54k forks source link

scope_url in FailureApp doesn't account for host #5596

Open philipithomas opened 1 year ago

philipithomas commented 1 year ago

Environment

Current behavior

I'm using devise on multiple domains, similar to the subdomain setup described in the docs, with confirmable and recoverable

Here's the issue I'm hitting:

  1. User signs up
  2. User tries to sign in with unconfirmed email
  3. App responds with redirect to root url default host, away from the current subdomain I'm on

Expected behavior

User should stay on the subdomain upon this error.

Technical details

Most session errors return a 422. But, this failure hits the FailureApp#scope_url method.

The issue is that the scope_url is not host-aware, but returns a url instead of a path. Therefore, the user may get redirected to a different host.

I believe the best way to fix this is to add opts[:host] = request.host to the scope_url function. I'm doing this with a custom failure app right now, and think it makes sense to incorporate into the main code base.