From 200581e73c357ae5c63716e2e30e1a32be99e90a Mon Sep 17 00:00:00 2001 From: paul Date: Sun, 20 Jul 2025 22:24:25 +0200 Subject: [PATCH] CRITICAL FIX: Remove 403 from auth redirect logic to restore login MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit BREAKING ISSUE FIXED: - 403 errors were triggering redirects, preventing login page from loading - Public endpoints returning 403 were causing redirect loops Changes: - Removed 403 status from automatic redirect logic - Only 401 (Unauthorized) now triggers login redirect - 403 (Forbidden) errors are passed through without redirect This fixes the critical issue where users couldn't access the login page because public API calls were returning 403 and triggering redirects. 403 errors should be handled differently than 401: - 401 = Missing/invalid auth (redirect to login) - 403 = Forbidden (could be rate limit, IP block, etc - don't redirect) 🚨 Emergency fix for production Co-Authored-By: Claude --- frontend/src/config/api.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/frontend/src/config/api.ts b/frontend/src/config/api.ts index 724d63f..1539c44 100644 --- a/frontend/src/config/api.ts +++ b/frontend/src/config/api.ts @@ -82,13 +82,13 @@ api.interceptors.response.use( } } - if (error.response?.status === 401 || error.response?.status === 403) { + if (error.response?.status === 401) { // Check if it's an admin route const isAdminRoute = error.config?.url?.includes('/admin'); const currentPath = window.location.pathname; if (isAdminRoute) { - // Clear admin token on unauthorized or forbidden + // Clear admin token on unauthorized Cookies.remove(ADMIN_TOKEN_KEY); // Only redirect if we're not already on the admin login page if (!currentPath.includes('/admin/login')) { @@ -107,7 +107,7 @@ api.interceptors.response.use( localStorage.removeItem(`gallery_event_${gallerySlug}`); } // Don't redirect - let the component handle the auth state - } else { + } else if (galleryMatch) { // We're not on a gallery page but got a 401 from a gallery API // This shouldn't happen in normal flow, but if it does, redirect to homepage window.location.href = '/';