A person who signs up from another site is not returned to it #93

New Issue

2026-09-21T07:18:28Z

cgalo5758 commented

2026-09-21 07:18:28 +00:00

What a person cannot do today

Go back to where they came from after signing up. A link to registration from a deployment's website or a wiki drops the person in the console when they finish, with no way back to the page that sent them.

What they should be able to do

Arrive at registration with a return address, complete sign-up, and land back on the originating page.

Why it matters

Sign-up is usually a detour from something the person was doing; ending it somewhere else loses them.

Where

The registration route (a return parameter kept in the session) and an origin allowlist so the return cannot be an open redirect.

Done when

A return address from an allowlisted origin survives the sign-up flow and is honored at the end; any other address is ignored.

## What a person cannot do today Go back to where they came from after signing up. A link to registration from a deployment's website or a wiki drops the person in the console when they finish, with no way back to the page that sent them. ## What they should be able to do Arrive at registration with a return address, complete sign-up, and land back on the originating page. ## Why it matters Sign-up is usually a detour from something the person was doing; ending it somewhere else loses them. ## Where The registration route (a return parameter kept in the session) and an origin allowlist so the return cannot be an open redirect. ## Done when A return address from an allowlisted origin survives the sign-up flow and is honored at the end; any other address is ignored.

cgalo5758 added the

kind

enhancement

area/identity security labels 2026-09-21 07:18:28 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: wiki-cafe/member-console#93