fix(url): only add redirect query parameter if non-empty

pkg/handler/reverseproxy_test.go

@@ -133,7 +133,7 @@ func TestReverseProxy(t *testing.T) {
 
 				location, err := resp.Location()
 				assert.NoError(t, err)
-				assert.Equal(t, idp.RelyingPartyServer.URL+"/oauth2/login?redirect=%2F", location.String())
+				assert.Equal(t, idp.RelyingPartyServer.URL+"/oauth2/login", location.String())
 			})
 		}
 	})
@@ -152,7 +152,7 @@ func TestReverseProxy(t *testing.T) {
 
 		resp := get(t, rpClient, target)
 		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode)
-		assert.Equal(t, idp.RelyingPartyServer.URL+"/oauth2/login?redirect=%2F", resp.Location.String())
+		assert.Equal(t, idp.RelyingPartyServer.URL+"/oauth2/login", resp.Location.String())
 	})
 
 	t.Run("with auto-login for navigation request without fetch metadata", func(t *testing.T) {

pkg/url/url.go

@@ -20,9 +20,11 @@ var ErrNoMatchingIngress = errors.New("request host does not match any configure
 func Login(target *url.URL, redirect string) string {
 	u := target.JoinPath(paths.OAuth2, paths.Login)
 
-	v := u.Query()
-	v.Set(RedirectQueryParameter, redirect)
-	u.RawQuery = v.Encode()
+	if len(redirect) > 0 {
+		v := u.Query()
+		v.Set(RedirectQueryParameter, redirect)
+		u.RawQuery = v.Encode()
+	}
 
 	return u.String()
 }

pkg/url/url_test.go

@@ -17,6 +17,12 @@ func TestLogin(t *testing.T) {
 		redirectTarget string
 		want           string
 	}{
+		{
+			name:           "empty target",
+			targetURL:      "https://sso.wonderwall",
+			redirectTarget: "",
+			want:           "https://sso.wonderwall/oauth2/login",
+		},
 		{
 			name:           "root path",
 			targetURL:      "https://sso.wonderwall",
@@ -59,6 +65,11 @@ func TestLoginRelative(t *testing.T) {
 		redirectTarget string
 		want           string
 	}{
+		{
+			name:           "empty target",
+			redirectTarget: "",
+			want:           "/oauth2/login",
+		},
 		{
 			name:           "no prefix",
 			prefix:         "",