Summary

When a user's session expires while a page is left open (keep-alive messages are not sent, e.g. suspended tab, laptop sleep, network interruption), the subsequent re-authentication viaOIDC does not redirect back to the page the user was on. Instead the user lands on the default page (home/dashboard) and has to navigate back manually.

Steps to reproduce

1. Log in via OIDC and open page A (e.g. a specific issue / build / commit page).
2. Prevent keep-alive from reaching the server until the session expires: suspend the tab, disconnect the network, or block the keep-alive endpoint.
3. After session expiry, perform an action on page A (click a link, refresh, or let the next AJAX request run).
4. Complete the OIDC login when prompted.

Expected behaviour

After successful OIDC login the user is returned to page A (the exact URL that was open when the session expired).

Actual behaviour

The user is redirected to the default landing page. The originally requested location is lost. Reproduces consistently via OIDC; behaviour may differ with the local username/password login form.

Environment

• OneDev version: OneDev 17.2.0 (but it has been happening on the past couple of major versions as well)
• OIDC provider: Authentik