Redirect /auth/* to app.seamtro.ai (Auth0 callback) #4

leora · 2026-10-17T02:16:56Z

leora commented

2026-10-17 02:16:56 +00:00

Follow-up to #3, from Code Reviewer finding (a): /auth/callback on seamtro.ai has no redirect rule and returns the landing 404. The old Seamtro app (now at app.seamtro.ai) handles Auth0 at /auth/*, so a login that still returns to seamtro.ai/auth/callback lands on a 404.

Adds a single rule: /auth/* 301 to https://app.seamtro.ai/auth/:splat. The query string (code, state) carries over. Not deployed. It goes to Pages production only after review and merge.

Follow-up to #3, from Code Reviewer finding (a): `/auth/callback` on seamtro.ai has no redirect rule and returns the landing 404. The old Seamtro app (now at app.seamtro.ai) handles Auth0 at /auth/*, so a login that still returns to seamtro.ai/auth/callback lands on a 404. Adds a single rule: `/auth/*` 301 to `https://app.seamtro.ai/auth/:splat`. The query string (code, state) carries over. Not deployed. It goes to Pages production only after review and merge.

leora added 1 commit 2026-10-17 02:16:57 +00:00

Redirect /auth/* (Auth0 callback etc.) to app.seamtro.ai fa92dd8267

leora requested review from code-reviewer 2026-10-17 02:16:57 +00:00

code-reviewer approved these changes 2026-10-17 02:20:48 +00:00

code-reviewer left a comment

First-time contributor

Approved at fa92dd8 (base main de1e93f).

Syntax and rule order: valid. The one new rule sits with the other prefix rules and overlaps none of them; there's no catch-all ahead of it. It doesn't touch /, /llms.txt, /.well-known/*, /robots.txt, /sitemap.xml or the 404 page. Bare /auth, without a slash, is not matched. That's fine unless something links there.

Open redirect: none. The target host is fixed (https://app.seamtro.ai/auth/), and :splat only fills in the path.

On the live site, /dashboard/%2f%2fevil.com already stays on app.seamtro.ai.
/auth/..%2f.. returns 400 at Cloudflare.

Query string: Pages keeps the query string on redirects; prod already does this for /form/a?b=1 and /api/x?q=1. So code and state will carry over.

301 vs 302/307: OK for a GET OAuth callback. Browsers cache a 301 heavily, though. If auth routing might ever move back to the apex, or change again, use 302 (or 307) instead. Non-blocking.

Live (read-only GETs, prod main de1e93f): not deployed yet. https://seamtro.ai/auth/callback?code=x&state=y returns 404 on both apex and www, which matches the PR description. After deploy, expect 301 → https://app.seamtro.ai/auth/callback?code=x&state=y.

Finding (b) is fixed: app.seamtro.ai /auth/callback with no code now returns 307 → https://app.seamtro.ai/?error=missing_code. That's the app host, not the apex.

Still open: the Stripe webhook endpoint change to https://app.seamtro.ai/api/webhooks/stripe is unconfirmed. Auth0 Allowed Callback URLs should still list the app.seamtro.ai callback; this rule is a safety net, not the primary path.

Privacy grep is clean.

Approved at fa92dd8 (base main de1e93f). **Syntax and rule order:** valid. The one new rule sits with the other prefix rules and overlaps none of them; there's no catch-all ahead of it. It doesn't touch `/`, `/llms.txt`, `/.well-known/*`, `/robots.txt`, `/sitemap.xml` or the 404 page. Bare `/auth`, without a slash, is not matched. That's fine unless something links there. **Open redirect: none.** The target host is fixed (`https://app.seamtro.ai/auth/`), and `:splat` only fills in the path. - On the live site, `/dashboard/%2f%2fevil.com` already stays on app.seamtro.ai. - `/auth/..%2f..` returns 400 at Cloudflare. **Query string:** Pages keeps the query string on redirects; prod already does this for `/form/a?b=1` and `/api/x?q=1`. So `code` and `state` will carry over. **301 vs 302/307:** OK for a GET OAuth callback. Browsers cache a 301 heavily, though. If auth routing might ever move back to the apex, or change again, use 302 (or 307) instead. Non-blocking. **Live (read-only GETs, prod main de1e93f):** not deployed yet. `https://seamtro.ai/auth/callback?code=x&state=y` returns 404 on both apex and www, which matches the PR description. After deploy, expect `301 → https://app.seamtro.ai/auth/callback?code=x&state=y`. **Finding (b) is fixed:** app.seamtro.ai `/auth/callback` with no code now returns `307 → https://app.seamtro.ai/?error=missing_code`. That's the app host, not the apex. **Still open:** the Stripe webhook endpoint change to `https://app.seamtro.ai/api/webhooks/stripe` is unconfirmed. Auth0 Allowed Callback URLs should still list the app.seamtro.ai callback; this rule is a safety net, not the primary path. Privacy grep is clean.

_redirects

						
				@ -11,6 +11,7 @@

				/dashboard/*    https://app.seamtro.ai/dashboard/:splat 301

				/form           https://app.seamtro.ai/form           301

				/form/*         https://app.seamtro.ai/form/:splat    301

				/auth/*         https://app.seamtro.ai/auth/:splat    301

code-reviewer commented

2026-10-17 02:20:48 +00:00

First-time contributor

OK for a GET callback, and code/state are kept. Consider 302/307 so browsers don't cache the route if auth ever moves again.

leora merged commit fa92dd8267 into main

2026-10-17 02:21:28 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: leora/landing#4