Add redirect URL to login requests

src/dotnet/APIView/APIViewWeb/Controllers/AccountController.cs

@@ -4,16 +4,22 @@
 using Microsoft.AspNetCore.Authorization;
 using APIViewWeb.Repositories;
 using APIViewWeb.Models;
+using System;
+using APIViewWeb.Helpers;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.Extensions.Hosting;
+using System.Linq;
 
 namespace APIViewWeb.Controllers
 {
     [AllowAnonymous]
     public class AccountController : Controller
     {
-        private readonly UserPreferenceCache _preferenceCache;
-        public AccountController(UserPreferenceCache preferenceCache)
+        public readonly IWebHostEnvironment _environment;
+
+        public AccountController(IWebHostEnvironment env)
         {
-            _preferenceCache = preferenceCache;
+            _environment = env;
         }
 
         [HttpGet]
@@ -22,7 +28,12 @@ public async Task<IActionResult> Login(string returnUrl = "/")
             await HttpContext.SignOutAsync();
             if (!Url.IsLocalUrl(returnUrl))
             {
-                returnUrl = "/";
+                string[] origins = (this._environment.IsDevelopment()) ? URlHelpers.GetAllowedStagingOrigins() : URlHelpers.GetAllowedProdOrigins();
+                Uri returnUri = new Uri(returnUrl);
+
+                if (!origins.Contains(returnUri.GetLeftPart(UriPartial.Authority))) {
+                    returnUrl = "/";
+                }
             }
             return Challenge(new AuthenticationProperties() { RedirectUri = returnUrl }, "GitHub");
         }

src/dotnet/APIView/APIViewWeb/Helpers/APIHelpers.cs

@@ -44,10 +44,10 @@ public class APIRevisionsFilterAndSortParams : ReviewFilterAndSortParams
     public class APIRevisionSoftDeleteParam
     {
         public string reviewId { get; set; }
-        public IEnumerable<string> apiRevisionIds { get; set;}
+        public IEnumerable<string> apiRevisionIds { get; set; }
     }
 
-    public class ReviewCreationParam                                                                    
+    public class ReviewCreationParam
     {
         public IFormFile File { get; set; }
         public string Language { get; set; }
@@ -74,7 +74,7 @@ public class LeanJsonResult : JsonResult
     {
         private readonly int _statusCode;
         private readonly string _locationUrl;
- 
+
         private static readonly JsonSerializerOptions _serializerOptions = new JsonSerializerOptions
         {
             PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
@@ -126,3 +126,4 @@ public PaginationHeader(int noOfItemsRead, int pageSize, int totalCount)
         public int TotalCount { get; set; }
     }
 }
+

src/dotnet/APIView/APIViewWeb/Helpers/URlHelpers.cs

@@ -0,0 +1,29 @@
+
+using System.Collections.Generic;
+
+namespace APIViewWeb.Helpers
+{
+    public class URlHelpers
+    {
+        public static List<string> GetAllowedOrigins()
+        {
+            return new List<string>() {
+                    "https://spa.apiviewuxtest.com",
+                    "https://spa.apiviewstagingtest.com",
+                    "https://spa.apiview.dev"
+                };
+        }
+
+        public static string[] GetAllowedProdOrigins()
+        {
+            return GetAllowedOrigins().ToArray();
+        }
+
+        public static string[] GetAllowedStagingOrigins()
+        {
+            var hosts = GetAllowedOrigins();
+            hosts.Add("https://localhost:4200");
+            return hosts.ToArray();
+        }
+    }
+}

src/dotnet/APIView/APIViewWeb/Startup.cs

@@ -35,6 +35,7 @@
 using Microsoft.Azure.Cosmos;
 using APIViewWeb.Managers.Interfaces;
 using Azure.Identity;
+using APIViewWeb.Helpers;
 
 namespace APIViewWeb
 {
@@ -226,13 +227,7 @@ public void ConfigureServices(IServiceCollection services)
             services.AddCors(options => {
                 options.AddPolicy("AllowCredentials", builder =>
                 {
-                    string [] origins = new string[] { 
-                        "https://localhost:4200",
-                        "https://spa.apiviewuxtest.com",
-                        "https://spa.apiviewstagingtest.com",
-                        "https://spa.apiview.dev"
-
-                    };
+                    string [] origins = (Environment.IsDevelopment()) ? URlHelpers.GetAllowedStagingOrigins() : URlHelpers.GetAllowedProdOrigins();
                     builder.WithOrigins(origins)
                         .AllowAnyMethod()
                         .AllowAnyHeader()

src/dotnet/APIView/ClientSPA/src/app/_guards/auth.guard.ts

@@ -15,12 +15,12 @@ export const AuthGuard: CanActivateFn = async (route: ActivatedRouteSnapshot, st
 
     if (isLoggedIn != true)
     {
-      window.location.href = configService.webAppUrl + "login";
+      window.location.href = configService.webAppUrl + "login?returnUrl=" + window.location.href;
     }
   }
   catch (error){
     isLoggedIn = false;
-    window.location.href = configService.webAppUrl + "login";
+    window.location.href = configService.webAppUrl + "login?returnUrl=" + window.location.href;
   }
   return isLoggedIn;
 };