From 349406723ce8cf114dca3a913300a41e493cb6bf Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sat, 16 May 2026 18:33:44 +0200
Subject: [PATCH] fix: use relative Location header in redirect

---
 app/api/auth/impersonate/route.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/app/api/auth/impersonate/route.ts b/app/api/auth/impersonate/route.ts
index 12f522b0..bcccff9a 100644
--- a/app/api/auth/impersonate/route.ts
+++ b/app/api/auth/impersonate/route.ts
@@ -122,5 +122,12 @@ export async function GET(request: NextRequest) {
 
   void recordLogin(impersonatedUsername, normalizedServerUrl);
 
-  return NextResponse.redirect(new URL('/', request.url), 303);
+  // Use a relative Location header so the browser resolves it against the
+  // public request URL. NextResponse.redirect(new URL('/', request.url))
+  // would absolutise to the container's internal bind (http://0.0.0.0:3000)
+  // when running behind a reverse proxy that doesn't set X-Forwarded-Host.
+  return new NextResponse(null, {
+    status: 303,
+    headers: { Location: '/' },
+  });
 }