Return path

Safe post-login navigation and OIDC redirect URI resolution. Prevents open redirects.

Import: @sumx/ssr-auth-core/return-path or barrel.

Sanitization & storage

Function	Description
`sanitizeReturnPath(path, options?)`	Allowlist internal paths; rejects external URLs
`getReturnPathFromState(state)`	Parse `state` from OIDC callback
`getReturnPathFromQueryParam()`	Read `returnPath` from current URL
`getNonHomeReturnPathFromQueryParam()`	Same, excluding `/`
`rememberReturnPath(path)`	`sessionStorage` persist
`readStoredReturnPath()` / `clearStoredReturnPath()`	Read / clear stored path
`pickPostLoginReturnPath(...)`	Choose best path after login

Function	Description
`shouldForcePromptLogin()`	User must re-authenticate interactively
`getPendingReturnPathFromAsPath(asPath)`	Path to restore from Next route

OIDC redirect URI

Function	Description
`resolveDefaultOidcRedirectUri(hints)`	Default callback URL for SPA
`resolveCanonicalOidcAppOrigin(hints)`	Canonical origin for redirects
`canUseReturnPathAsOidcRedirectUri(path, hints)`	Per-login redirect URI feature flag
`buildPerLoginOidcRedirectUriIfEnabled(...)`	Dynamic redirect when enabled

Portal sets siteConfig.useReturnPathAsOidcRedirectUri in CheckToken deps.

Server gate (`return-path-gate.server`)


import { evaluateReturnPathAccess } from '@sumx/ssr-auth-core/return-path-gate.server';
 
const result = evaluateReturnPathAccess({
  returnPath,
  permissions, // from BFF
});

Called during session establish so users cannot land on routes they lack permission for.

Example (client)


import { sanitizeReturnPath, rememberReturnPath } from '@sumx/ssr-auth-core/return-path';
 
const next = sanitizeReturnPath('/invoices/123');
if (next) rememberReturnPath(next);

Security

Only relative paths on the app origin pass sanitization.
Reject //, http:, encoded tricks — see implementation tests in kit repo.