auth.admin.generateLink does not return proper redirectTo

[apertureless]

Bug report

Describe the bug

I am using auth.admin.generateLink with type magiclink in an edge function and passing the redirectTo param. However the generated link does not respect the provided redirectTo param and returns the site url.

To Reproduce

 const { data: linkData, error: linkError } =
    await supabaseClient.auth.admin.generateLink({
      type: "magiclink",
      email: email,
      options: {
        data: {
          orga: orga_id,
        },
        redirectTo: "http://localhost:3000/confirm",
      },
    });

After triggering the edge function locally this is the response:

[Info] [Generated link: ] http://127.0.0.1:54321/auth/v1/verify?token=9cdd921dc47c0e1b136f3659e6926f45697209047abc95d7964efb67&type=magiclink&redirect_to=http://127.0.0.1:3000/auth/login

[Info] [Generated linkdata: ] {
  action_link: "http://127.0.0.1:54321/auth/v1/verify?token=9cdd921dc47c0e1b136f3659e6926f45697209047abc95d7964efb67"... 60 more characters,
  email_otp: "275123",
  hashed_token: "9cdd921dc47c0e1b136f3659e6926f45697209047abc95d7964efb67",
  redirect_to: "http://127.0.0.1:3000/auth/login",
  verification_type: "magiclink"
}

Expected behavior

redirect_to should be set to the param provided (http://localhost:3000/confirm) instead of http://127.0.0.1:3000/auth/login

[encima]

Hi there,

thanks for opening. I believe there have been a few reports of this so I will move this to the Auth repo for the team to respond.

[apertureless]

Well I could pinpoint my issue here. It has to do, with the undocumented fact, that the redirect_url has to be from the same host / site ? https://github.com/supabase/auth/blob/master/internal/utilities/request.go#L91

If I change the redirectTo param in my example to http://127.0.0.1/confirm it works.

However, I am not sure how I feel about this, because in my case I will run the auth.admin.generateLink in an edge function which will be triggered from app-a and should generate a magic-link and redirect to app-b but this does not seem to be possible, right?

[kangmingtay]

@apertureless have you verified that you've add the redirect url to the allow list: https://supabase.com/docs/guides/auth/redirect-urls?

[apertureless]

I've added localhost and 127.0.0.1 to the config

[gdaybrice]

@encima running into that issue, any workarounds please?

[encima]

@blechatellier can you confirm the library version you are running?

[gdaybrice]

@encima figured out the issue, auth sets the cookie on localhost but gotrue redirects to 127.0.0.1 and no way to change this in the settings I believe.

[joshdance]

I am facing this as well. auth.admin.generateLink does not respect the set redirect URL, always redirects back to the site URL.

Any workarounds until this is fixed?

[risaruno]

Please check whether you have inserted the redirect URL into the permitted list as mentioned here. https://supabase.com/docs/guides/auth/redirect-urls#use-wildcards-in-redirect-urls You can use wildcards to add your URL to the list.

I assume you only add your host to the list like: http://127.0.0.1

Instead, you should do: http://127.0.0.1:3000/confirm or http://127.0.0.1:3000/* or http://127.0.0.1:3000/**