Skip to content

fix: navigate directly to Google authorize endpoints #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
amrtgaber merged 1 commit into from
May 27, 2026
Merged

fix: navigate directly to Google authorize endpoints #44

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 9 additions & 16 deletions src/pages/login/login-page.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,26 +44,19 @@ export function LoginPage() {
}
}

async function handleGoogleLogin() {
try {
if (redirect) localStorage.setItem("auth_redirect", redirect)
const res = await api
.get("auth/google/authorize")
.json<{ authorization_url: string }>()
window.location.href = res.authorization_url
} catch (error) {
const message = await getErrorMessage(
error,
"Failed to start Google sign-in"
)
toast.error(message)
}
function handleGoogleLogin() {
if (redirect) localStorage.setItem("auth_redirect", redirect)
// The authorize endpoint 302s to accounts.google.com in production.
// Fetching it would follow the redirect via fetch, which the browser
// blocks because accounts.google.com isn't in our CSP connect-src.
// Direct navigation sidesteps connect-src entirely.
window.location.href = `${baseUrl}/auth/google/authorize`
}

function handleSteamLogin() {
if (redirect) localStorage.setItem("auth_redirect", redirect)
// In production, the authorize endpoint returns a 307 redirect to Steam,
// so we navigate directly instead of fetching (avoids CSP issues).
// Same reasoning as handleGoogleLogin: the authorize endpoint 307s to
// Steam's OpenID, so we navigate directly to avoid a CSP-blocked fetch.
window.location.href = `${baseUrl}/auth/steam/authorize`
}

Expand Down
27 changes: 7 additions & 20 deletions src/pages/profile/profile-page.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,27 +165,14 @@ export function ProfilePage() {
}
}

async function handleConnect(provider: ProviderId) {
function handleConnect(provider: ProviderId) {
setConnectingProvider(provider)
try {
if (provider === "steam") {
// Steam's authorize endpoint 307s straight to Steam's OpenID; navigate
// there directly to keep the redirect chain server-driven.
window.location.href = `${baseUrl}/auth/steam/associate/authorize`
return
}
const res = await api
.get(`auth/${provider}/associate/authorize`)
.json<{ authorization_url: string }>()
window.location.href = res.authorization_url
} catch (error) {
const message = await getErrorMessage(
error,
`Failed to start linking ${provider}`
)
toast.error(message)
setConnectingProvider(null)
}
// Both providers' associate-authorize endpoints 302 to the provider in
// production. Fetching first would let the browser follow the redirect
// via fetch — CSP connect-src blocks the cross-origin call to
// accounts.google.com / steamcommunity.com. Direct navigation
// sidesteps connect-src entirely.
window.location.href = `${baseUrl}/auth/${provider}/associate/authorize`
}

async function handleDisconnect(provider: ProviderId) {
Expand Down
Loading