From 8027f5f0a63425c280121d671ae843e4c420793b Mon Sep 17 00:00:00 2001
From: Geido <60598000+geido@users.noreply.github.com>
Date: Tue, 15 Feb 2022 16:59:06 +0200
Subject: [PATCH] fix: Only redirect to relative paths when authentication
 expires (#18714)

* Only redirect to relative paths

* Fix redirect test
---
 .../src/connection/SupersetClientClass.ts             |  4 +++-
 .../test/connection/SupersetClientClass.test.ts       | 11 +++++++++--
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/superset-frontend/packages/superset-ui-core/src/connection/SupersetClientClass.ts b/superset-frontend/packages/superset-ui-core/src/connection/SupersetClientClass.ts
index 39d5022be8a0..fa75148afe62 100644
--- a/superset-frontend/packages/superset-ui-core/src/connection/SupersetClientClass.ts
+++ b/superset-frontend/packages/superset-ui-core/src/connection/SupersetClientClass.ts
@@ -232,6 +232,8 @@ export default class SupersetClientClass {
   }
 
   redirectUnauthorized() {
-    window.location.href = `/login?next=${window.location.href}`;
+    window.location.href = `/login?next=${
+      window.location.pathname + window.location.search
+    }`;
   }
 }
diff --git a/superset-frontend/packages/superset-ui-core/test/connection/SupersetClientClass.test.ts b/superset-frontend/packages/superset-ui-core/test/connection/SupersetClientClass.test.ts
index 4efd4f43ca68..ae6ac138d5a6 100644
--- a/superset-frontend/packages/superset-ui-core/test/connection/SupersetClientClass.test.ts
+++ b/superset-frontend/packages/superset-ui-core/test/connection/SupersetClientClass.test.ts
@@ -501,11 +501,16 @@ describe('SupersetClientClass', () => {
 
   it('should redirect Unauthorized', async () => {
     const mockRequestUrl = 'https://host/get/url';
+    const mockRequestPath = '/get/url';
+    const mockRequestSearch = '?param=1&param=2';
     const { location } = window;
     // @ts-ignore
     delete window.location;
     // @ts-ignore
-    window.location = { href: mockRequestUrl };
+    window.location = {
+      pathname: mockRequestPath,
+      search: mockRequestSearch,
+    };
     const authSpy = jest
       .spyOn(SupersetClientClass.prototype, 'ensureAuth')
       .mockImplementation();
@@ -523,7 +528,9 @@ describe('SupersetClientClass', () => {
       error = err;
     } finally {
       const redirectURL = window.location.href;
-      expect(redirectURL).toBe(`/login?next=${mockRequestUrl}`);
+      expect(redirectURL).toBe(
+        `/login?next=${mockRequestPath + mockRequestSearch}`,
+      );
       expect(error.status).toBe(401);
     }