From a02f11597e4763e866f4c11bff2141b42de3552d Mon Sep 17 00:00:00 2001 From: Mike Dalton Date: Sun, 5 Jul 2026 10:59:23 -0400 Subject: [PATCH] Strip HTTP Basic-Auth credentials from the URL Loading production via a credentialed URL (https://user:pass@host) leaves the credentials in document.URL. Turbo passes the credential-free URL to history.replaceState(), the browser treats the two as mismatched origins, and throws a SecurityError that cascades and breaks login. Add a Stimulus controller on that detects credentials in location and redirects to the clean URL; the browser has already cached the auth, so the navigation stays authenticated. Co-Authored-By: Claude Opus 4.8 --- .../strip_url_credentials_controller.js | 17 +++++++++++++++++ app/views/layouts/application.html.erb | 2 +- 2 files changed, 18 insertions(+), 1 deletion(-) create mode 100644 app/javascript/controllers/strip_url_credentials_controller.js diff --git a/app/javascript/controllers/strip_url_credentials_controller.js b/app/javascript/controllers/strip_url_credentials_controller.js new file mode 100644 index 0000000..4904ae8 --- /dev/null +++ b/app/javascript/controllers/strip_url_credentials_controller.js @@ -0,0 +1,17 @@ +import { Controller } from "@hotwired/stimulus" + +// Strips HTTP Basic-Auth credentials from the URL (e.g. https://user:pass@host). +// The user:pass@ form makes document.URL mismatch the credential-free URL Turbo +// passes to history.replaceState(), throwing a SecurityError that breaks the page. +// The browser has already cached the credentials, so the clean navigation below +// stays authenticated. +export default class extends Controller { + connect() { + const url = new URL(window.location.href) + if (url.username || url.password) { + url.username = "" + url.password = "" + window.location.replace(url.toString()) + } + } +} diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb index e47e452..70ee5a4 100644 --- a/app/views/layouts/application.html.erb +++ b/app/views/layouts/application.html.erb @@ -27,7 +27,7 @@ <%= javascript_importmap_tags %> - +