From f295b3f7ddad23d261c855659111b43d817816b0 Mon Sep 17 00:00:00 2001 From: Bryan Brooks Date: Wed, 18 Feb 2026 21:53:34 -0600 Subject: [PATCH] fix: use req.is('json') instead of req.accepts('json') for content negotiation req.accepts('json') matches the wildcard */* in browser form submissions, causing native form POSTs to get JSON responses instead of 302 redirects. req.is('json') checks the request Content-Type, which correctly differentiates fetch (application/json) from native forms (x-www-form-urlencoded). --- gateway/src/routes/oidc/authorize.ts | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/gateway/src/routes/oidc/authorize.ts b/gateway/src/routes/oidc/authorize.ts index 9fb00f9..6b9942f 100644 --- a/gateway/src/routes/oidc/authorize.ts +++ b/gateway/src/routes/oidc/authorize.ts @@ -391,15 +391,17 @@ export function createAuthorizeRouter( created_at: Math.floor(Date.now() / 1000), }); - // Return redirect URL — JSON for fetch clients, 302 for form fallback - if (req.accepts('json')) { + // Return redirect URL — JSON for fetch clients, 302 for native form fallback + const isJsonRequest = req.is('json'); + if (isJsonRequest) { res.json({ redirect_url: atprotoAuth.url }); } else { res.redirect(atprotoAuth.url); } } catch (error) { console.error('[OIDC Login] Error:', error); - if (req.accepts('json')) { + const isJsonRequest = req.is('json'); + if (isJsonRequest) { res.status(500).json({ error: 'Authentication failed: ' + (error instanceof Error ? error.message : 'Unknown error') }); } else { res.status(500).send('Authentication failed: ' + (error instanceof Error ? error.message : 'Unknown error')); -- knotmirror 0.0.1