diff --git a/.changeset/cyan-buttons-obey.md b/.changeset/cyan-buttons-obey.md new file mode 100644 index 000000000..9052139ab --- /dev/null +++ b/.changeset/cyan-buttons-obey.md @@ -0,0 +1,5 @@ +--- +'@keystatic/core': patch +--- + +Only redirect to loopback if the storage uses OAuth redirects. diff --git a/packages/keystatic/src/app/ui.tsx b/packages/keystatic/src/app/ui.tsx index e4501a355..541ef7d96 100644 --- a/packages/keystatic/src/app/ui.tsx +++ b/packages/keystatic/src/app/ui.tsx @@ -4,6 +4,7 @@ import { useContext, useEffect, useState, + Fragment, } from 'react'; import { Button } from '@keystar/ui/button'; @@ -269,6 +270,10 @@ function AuthWrapper(props: { return null; } +/** + * Use loopback instead of localhost to follow OAuth best practices. + * Learn more: https://datatracker.ietf.org/doc/html/rfc8252#section-8.3 + */ function RedirectToLoopback(props: { children: ReactNode }) { useEffect(() => { if (window.location.hostname === 'localhost') { @@ -292,9 +297,13 @@ export function Keystatic(props: { assertValidRepoConfig(props.config.storage.repo); } + // The loopback redirect is only needed if the storage uses OAuth callbacks. + const Wrapper = + props.config.storage.kind === 'local' ? Fragment : RedirectToLoopback; + return ( - + @@ -302,7 +311,7 @@ export function Keystatic(props: { - + ); }