chaitin · twursc · Aug 7, 2026
diff --git a/backend/biz/user/handler/v1/auth.go b/backend/biz/user/handler/v1/auth.go
@@ -4,12 +4,15 @@ import (
 	"fmt"
 	"log/slog"
 	"net/http"
+	"net/url"
+	"time"
 
 	"github.com/GoYoko/web"
 	"github.com/google/uuid"
 	"github.com/redis/go-redis/v9"
 	"github.com/samber/do"
 
+	"github.com/chaitin/MonkeyCode/backend/biz/user/provider"
 	"github.com/chaitin/MonkeyCode/backend/config"
 	"github.com/chaitin/MonkeyCode/backend/consts"
 	"github.com/chaitin/MonkeyCode/backend/domain"
@@ -31,6 +34,8 @@ type AuthHandler struct {
 	captcha        *captcha.Captcha
 }
 
+const oidcLoginRedirectKeyPrefix = "oidc_login_redirect:"
+
 // NewAuthHandler 创建认证处理器 (samber/do 风格)
 func NewAuthHandler(i *do.Injector) (*AuthHandler, error) {
 	w := do.MustInvoke[*web.Web](i)
@@ -98,10 +103,26 @@ func (h *AuthHandler) OIDCLogin(c *web.Context, req domain.TeamOIDCLoginReq) err
 	if h.oidcUsecase == nil {
 		return errcode.ErrOIDCDisabled
 	}
+	redirectURL, err := provider.CleanRedirectURL(req.RedirectURL)
+	if err != nil {
+		return errcode.ErrOAuthLoginRedirectInvalid
+	}
 	authURL, err := h.oidcUsecase.StartLogin(c.Request().Context(), req.TeamID)
 	if err != nil {
 		return err
 	}
+	parsedAuthURL, err := url.Parse(authURL)
+	if err != nil || parsedAuthURL.Query().Get("state") == "" {
+		return errcode.ErrInternalServer
+	}
+	if err := h.redis.Set(
+		c.Request().Context(),
+		oidcLoginRedirectKeyPrefix+parsedAuthURL.Query().Get("state"),
+		redirectURL,
+		10*time.Minute,
+	).Err(); err != nil {
+		return errcode.ErrInternalServer
+	}
 	return c.Redirect(http.StatusFound, authURL)
 }
 
@@ -119,16 +140,26 @@ func (h *AuthHandler) OIDCCallback(c *web.Context, req domain.TeamOIDCCallbackRe
 	if h.oidcUsecase == nil {
 		return errcode.ErrOIDCDisabled
 	}
-	user, err := h.oidcUsecase.HandleCallback(c.Request().Context(), &req)
+	ctx := c.Request().Context()
+	redirectURL, err := h.redis.Get(ctx, oidcLoginRedirectKeyPrefix+req.State).Result()
+	if err == redis.Nil {
+		redirectURL = "/console/"
+	} else if err != nil {
+		return errcode.ErrInternalServer
+	}
+	user, err := h.oidcUsecase.HandleCallback(ctx, &req)
 	if err != nil {
 		return err
 	}
 	_, err = h.authMiddleware.Session.Save(c, consts.MonkeyCodeAISession, user.ID, user)
 	if err != nil {
-		h.logger.ErrorContext(c.Request().Context(), "save oidc session failed", "error", err)
+		h.logger.ErrorContext(ctx, "save oidc session failed", "error", err)
 		return errcode.ErrInternalServer
 	}
-	return c.Redirect(http.StatusFound, "/console/")
+	if err := h.redis.Del(ctx, oidcLoginRedirectKeyPrefix+req.State).Err(); err != nil {
+		h.logger.WarnContext(ctx, "delete oidc login redirect failed", "error", err)
+	}
+	return c.Redirect(http.StatusFound, redirectURL)
 }
 
 // OIDCPublicConfig 获取团队公开 OIDC 登录配置

diff --git a/backend/domain/team_oidc.go b/backend/domain/team_oidc.go
@@ -81,7 +81,8 @@ type TeamOIDCPublicConfigResp struct {
 }
 
 type TeamOIDCLoginReq struct {
-	TeamID uuid.UUID `query:"team_id" validate:"required"`
+	TeamID      uuid.UUID `query:"team_id" validate:"required"`
+	RedirectURL string    `query:"redirect_url"`
 }
 
 type TeamOIDCCallbackReq struct {

diff --git a/frontend/src/pages/login.tsx b/frontend/src/pages/login.tsx
@@ -21,7 +21,7 @@ import { Spinner } from "@/components/ui/spinner"
 import React from "react"
 import { toast } from "sonner"
 import { apiRequest } from "@/utils/requestUtils"
-import { Link, useNavigate } from "react-router-dom"
+import { Link, useNavigate, useSearchParams } from "react-router-dom"
 import { captchaChallenge } from "@/utils/common"
 import { ArrowLeft, Eye, EyeOff } from "lucide-react"
 import { IconBrandGithub, IconBrandGoogle } from "@tabler/icons-react"
@@ -33,8 +33,17 @@ import { useAppRuntime } from "@/components/app-runtime-provider"
 
 const USER_STORAGE_KEY = 'login_user'
 const MANAGER_STORAGE_KEY = 'login_manager'
+const DEFAULT_USER_REDIRECT = '/console/tasks'
 type OAuthProvider = "github" | "google"
 
+// 仅接受站内绝对路径，避免 redir 被用于跳转到外部站点。
+function sanitizeRedirect(raw: string | null): string {
+  if (!raw) return ''
+  if (/[\r\n\t\\]/.test(raw)) return ''
+  if (!raw.startsWith('/') || raw.startsWith('//')) return ''
+  return raw
+}
+
 export default function LoginPage({
   className,
   ...props
@@ -51,14 +60,19 @@ export default function LoginPage({
   const [oauthLoggingProvider, setOauthLoggingProvider] = React.useState<OAuthProvider | null>(null)
   const [defaultOIDCConfig, setDefaultOIDCConfig] = React.useState<DomainTeamOIDCPublicConfigResp | null>(null)
   const navigate = useNavigate()
+  const [searchParams] = useSearchParams()
+  const userRedirect = sanitizeRedirect(searchParams.get('redir')) || DEFAULT_USER_REDIRECT
   const { t } = useTranslation()
   const { captchaEnabled, reloadAuth, serverConfig } = useAppRuntime()
   const serverRegion = serverConfig?.region as string | undefined
   const isCnRegion = serverRegion === "cn"
   const isGlobalRegion = serverRegion === "global"
   const inviterId = typeof window !== 'undefined' ? (localStorage.getItem('ic') || '') : ''
-  const userLoginHref = `/api/v1/users/login?redirect=&inviter_id=${inviterId}`
+  const userLoginHref = `/api/v1/users/login?redirect=${encodeURIComponent(userRedirect)}&inviter_id=${inviterId}`
   const defaultOIDCLoginURL = defaultOIDCConfig?.enabled ? defaultOIDCConfig.login_url : ''
+  const defaultOIDCLoginHref = defaultOIDCLoginURL
+    ? `${defaultOIDCLoginURL}${defaultOIDCLoginURL.includes('?') ? '&' : '?'}redirect_url=${encodeURIComponent(userRedirect)}`
+    : ''
 
   const ensureTermsAccepted = React.useCallback(() => {
     if (agreedToTerms) return true
@@ -126,7 +140,7 @@ export default function LoginPage({
         if (resp.code === 0) {
           localStorage.setItem(USER_STORAGE_KEY, JSON.stringify({ email: userEmail.trim(), password: userPassword.trim() }))
           await reloadAuth()
-          navigate('/console/tasks')
+          window.location.assign(userRedirect)
         } else {
           toast.error(t("login.toast.loginFailed"))
         }
@@ -145,7 +159,7 @@ export default function LoginPage({
 
     try {
       const response = await new Api().api.v1UsersOauthLoginDetail(provider, {
-        redirect_url: "/console/tasks",
+        redirect_url: userRedirect,
       })
       const authUrl = response.data?.data?.auth_url
 
@@ -259,7 +273,7 @@ export default function LoginPage({
                       {IS_OFFLINE_EDITION && defaultOIDCLoginURL && (
                         <Button size="lg" className="w-full" asChild>
                           <a
-                            href={defaultOIDCLoginURL}
+                            href={defaultOIDCLoginHref}
                             onClick={(e) => {
                               if (!ensureTermsAccepted()) {
                                 e.preventDefault()