Preserve safe return paths through sign-in

internal/web/middleware.go

@@ -43,7 +43,7 @@ func (app *application) recoverPanic(next http.Handler) http.Handler {
 func (app *application) requireAuthentication(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if !app.isAuthenticated(r) {
-			http.Redirect(w, r, webPath("login"), http.StatusSeeOther)
+			http.Redirect(w, r, loginPathForRequest(r), http.StatusSeeOther)
 			return
 		}
 		w.Header().Set("Cache-Control", "no-store")
@@ -51,6 +51,18 @@ func (app *application) requireAuthentication(next http.Handler) http.Handler {
 	})
 }
 
+func loginPathForRequest(r *http.Request) string {
+	loginPath := webPath("login")
+	if r.Method != http.MethodGet {
+		return loginPath
+	}
+	returnTo := safeReturnPath(r.URL.RequestURI())
+	if returnTo == "" {
+		return loginPath
+	}
+	return pathWithQuery(loginPath, "return_to", returnTo)
+}
+
 func (app *application) requireActivatedUser(next http.Handler) http.Handler {
 	return app.requireAuthentication(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		user, ok := userFromContext(r.Context())