Skip to content

VIBECODED fix voor #164 #181

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
seanscodes merged 4 commits into from
Mar 9, 2026
Merged

VIBECODED fix voor #164 #181

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
38d5de7
Initial plan
Claude Mar 9, 2026
4252bde
Fix Safari/WebKit manifest.json redirect bug
Claude Mar 9, 2026
f726c2f
Add AI CODE START/END markers to Safari manifest.json bug fix
Claude Mar 9, 2026
66485c1
Merge pull request #1 from SSoggyTacoMan/claude/fix-auth-flows-bug-164
SSoggyTacoMan Mar 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion src/proxy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,9 @@ export async function proxy(request: NextRequest) {
pathname.startsWith("/_next") ||
// pathname.startsWith("/api") ||
pathname === "/favicon.ico" ||
/\.(css|js|ts|tsx|jsx|woff2?|ttf|png|jpg|jpeg|gif|svg|webmanifest)$/.test(pathname) ||
// AI CODE START
/\.(css|js|ts|tsx|jsx|woff2?|ttf|png|jpg|jpeg|gif|svg|webmanifest|json)$/.test(pathname) ||
Comment on lines +15 to +16
Copy link

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adding json to the “static files” extension allowlist means any *.json request will bypass the bot/scanner detection and the auth gate below. If the intent is only to let /manifest.json through, it would be safer to special-case that path (or narrowly whitelist known public JSON assets) rather than exempting all JSON paths.

Suggested change
// AI CODE START
/\.(css|js|ts|tsx|jsx|woff2?|ttf|png|jpg|jpeg|gif|svg|webmanifest|json)$/.test(pathname) ||
pathname === "/manifest.json" ||
// AI CODE START
/\.(css|js|ts|tsx|jsx|woff2?|ttf|png|jpg|jpeg|gif|svg|webmanifest)$/.test(pathname) ||

Copilot uses AI. Check for mistakes.
// AI CODE END
request.headers.get("purpose") === "prefetch" ||
request.headers.get("Next-Router-Prefetch") === "1" ||
request.headers.get("RSC") === "1" ||
Expand Down
4 changes: 3 additions & 1 deletion src/utils/auth/redirect.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,9 @@ export function getValidRedirectPath(path: string | null | undefined): string {
}

// Blacklist certain paths for security
const blockedPaths = ['/api/', '/auth/sign-out'];
// AI CODE START
const blockedPaths = ['/api/', '/auth/sign-out', '/manifest.json'];
// AI CODE END
if (blockedPaths.some(blocked => path.startsWith(blocked))) {
Comment on lines +31 to 33
Copy link

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

blockedPaths is recreated on every call to getValidRedirectPath. Since it’s a static blacklist, consider moving it to module scope (or making it const outside the function) to avoid repeated allocations and keep the function focused on validation logic.

Copilot uses AI. Check for mistakes.
return defaultPath;
}
Expand Down
Loading