handbook: clear the OAuth callback parameters off the Studio landing page - #5809
Merged
Merged
Conversation
✅ Deploy Preview for flowfuse-website ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
…page Studio's GitHub sign-in returns to /__nuxt_studio/auth/github?code=&iss=&state=, and that handler finishes by redirecting to the page you asked to edit. This host appends the request's own query string to every relative redirect Location, so the three OAuth parameters ride along and the landing URL reads https://flowfuse.com/handbook/?code=...&iss=https://github.com/login/oauth&state=... Sign-in has already completed at that point and nothing reads them, but they leave a spent authorization code in the URL bar and in browser history, and state is unique per sign-in, so every landing also reports its own $current_url to PostHog instead of the page's real URL. A small inline script in <head> drops the three parameters with history.replaceState. It is inline and in the head so it runs before the PostHog snippet appended at the end of <body>, and before Nuxt boots, so the router starts from the cleaned URL. It only acts when both a code and GitHub's own iss value are present.
dimitrieh
force-pushed
the
fix/studio-oauth-callback-params
branch
from
September 15, 2026 14:17
1de2c39 to
b9d1391
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
After signing in to Studio, you land on a clean URL instead of one carrying GitHub's OAuth parameters.
/handbook/?code=4b55bf56c558e9767106&iss=https://github.com/login/oauth&state=phtnIFy-.../handbook/Why it matters:
stateis different on every sign-in, so today each one reports its own$current_urlto PostHog and the handbook's page stats split into a new row per sign-in. A spent authorization code also sits in the URL bar and browser history, and travels along if anyone copies the link.Follow-up to #5690. Sign-in itself works and is unchanged.
Where the parameters come from
This host appends the request's own query string to every relative redirect
Location. A junk parameter shows it:GitHub returns to
/__nuxt_studio/auth/github?code=&iss=&state=. That handler finishes by redirecting to the page you asked to edit, and the query it was called with rides along. Nothing reads the parameters by then.How it is fixed
A small inline script in
<head>drops the three parameters withhistory.replaceState.Inline and in the head on purpose: it has to run before the PostHog snippet, which is appended at the end of
<body>, and before Nuxt boots so the router starts from the cleaned URL.It only acts when a
codeand GitHub's ownissvalue are both present, so an unrelated?code=elsewhere on the site is untouched.Testing
Against the deploy preview:
/handbook/,location.searchempty, page rendered normally, andhistory.lengthunchanged so it replaces rather than adds an entry;/handbook/?utm_source=slack&code=PROMO20is left exactly as-is.The snippet was also checked directly against a foreign
iss, unrelated query parameters on the same landing (kept), and a hash fragment (kept).Related Issue(s)
None.
Checklist