From 80a0bcb6803a245fafce4845e38e2fe56262c07b Mon Sep 17 00:00:00 2001
From: shenlan <manbuzhe2009@qq.com>
Date: Mon, 13 Oct 2025 16:10:54 +0800
Subject: [PATCH] Fix register endpoint to prefer same-origin URL (#516)

---
 ui/homepage/app/register/RegisterContent.tsx | 44 +++++++++++++++++---
 1 file changed, 38 insertions(+), 6 deletions(-)

diff --git a/ui/homepage/app/register/RegisterContent.tsx b/ui/homepage/app/register/RegisterContent.tsx
index fd63eb0..2fccdd2 100644
--- a/ui/homepage/app/register/RegisterContent.tsx
+++ b/ui/homepage/app/register/RegisterContent.tsx
@@ -45,15 +45,47 @@ function ensureHttpsForSameHost(url: string): string {
   }
 }
 
+const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '[::1]'])
+
+function preferSameOrigin(url: string): string {
+  if (typeof window === 'undefined') {
+    return url
+  }
+
+  try {
+    const currentOrigin = window.location.origin
+    const parsed = new URL(url, currentOrigin)
+
+    const parsedHostname = parsed.hostname.toLowerCase()
+    const browserHostname = window.location.hostname.toLowerCase()
+
+    const parsedIsLocal = LOCAL_HOSTNAMES.has(parsedHostname)
+    const browserIsLocal = LOCAL_HOSTNAMES.has(browserHostname)
+
+    if (!browserIsLocal && parsedIsLocal) {
+      return `${parsed.pathname}${parsed.search}${parsed.hash}` || '/api/auth/register'
+    }
+
+    if (parsed.origin === currentOrigin) {
+      return `${parsed.pathname}${parsed.search}${parsed.hash}` || '/api/auth/register'
+    }
+
+    return parsed.toString()
+  } catch (error) {
+    console.warn('Failed to prefer same-origin register URL, falling back to provided value', error)
+    return url
+  }
+}
+
 function coerceRegisterUrlOverride(rawValue: string | undefined | null, accountServiceBaseUrl: string): string {
   const fallbackUrl = `${accountServiceBaseUrl}/api/auth/register`
   if (!rawValue) {
-    return ensureHttpsForSameHost(fallbackUrl)
+    return preferSameOrigin(ensureHttpsForSameHost(fallbackUrl))
   }
 
   const trimmed = rawValue.trim()
   if (!trimmed) {
-    return ensureHttpsForSameHost(fallbackUrl)
+    return preferSameOrigin(ensureHttpsForSameHost(fallbackUrl))
   }
 
   const rewritePathname = (pathname: string) => {
@@ -69,20 +101,20 @@ function coerceRegisterUrlOverride(rawValue: string | undefined | null, accountS
     const rewritten = rewritePathname(parsed.pathname)
     if (rewritten) {
       parsed.pathname = rewritten
-      return ensureHttpsForSameHost(parsed.toString())
+      return preferSameOrigin(ensureHttpsForSameHost(parsed.toString()))
     }
-    return ensureHttpsForSameHost(parsed.toString())
+    return preferSameOrigin(ensureHttpsForSameHost(parsed.toString()))
   } catch (error) {
     try {
       const parsed = new URL(trimmed, 'http://localhost')
       const rewritten = rewritePathname(parsed.pathname)
       if (rewritten) {
-        return ensureHttpsForSameHost(`${rewritten}${parsed.search}${parsed.hash}`)
+        return preferSameOrigin(ensureHttpsForSameHost(`${rewritten}${parsed.search}${parsed.hash}`))
       }
     } catch (relativeError) {
       console.warn('Failed to parse register URL override', relativeError)
     }
-    return ensureHttpsForSameHost(trimmed)
+    return preferSameOrigin(ensureHttpsForSameHost(trimmed))
   }
 }