From 47995ed03baeae379afbd0ce3b7af5361eb9ac52 Mon Sep 17 00:00:00 2001 From: Mehtab Singh Date: Mon, 18 May 2026 12:46:11 +0530 Subject: [PATCH] fix: pass JWT via URL fragment instead of query param in mobile redirect --- apps/backend/src/routes/auth.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/apps/backend/src/routes/auth.ts b/apps/backend/src/routes/auth.ts index e12f10a..1826b71 100644 --- a/apps/backend/src/routes/auth.ts +++ b/apps/backend/src/routes/auth.ts @@ -117,10 +117,10 @@ export async function authRoutes(app: FastifyInstance) { { expiresIn: '30d' } ); - // For mobile app: redirect with token as query param + // For mobile app: redirect with token as URL fragment (not sent to servers, keeps token out of logs) const mobileRedirect = process.env.MOBILE_REDIRECT_URI; if (request.query.state?.startsWith('mobile_')) { - return reply.redirect(`${mobileRedirect}?token=${token}`); + return reply.redirect(`${mobileRedirect}#token=${token}`); } // For web: set cookie and redirect @@ -222,7 +222,7 @@ export async function authRoutes(app: FastifyInstance) { if (request.query.state?.startsWith('mobile_')) { const mobileRedirect = process.env.MOBILE_REDIRECT_URI; - return reply.redirect(`${mobileRedirect}?token=${token}`); + return reply.redirect(`${mobileRedirect}#token=${token}`); } reply.setCookie('token', token, {