From 334c71423b05954830e745090d5353e696bde43c Mon Sep 17 00:00:00 2001
From: "Calum H. (IMB11)" <contact@cal.engineer>
Date: Fri, 24 Jul 2026 18:54:08 +0100
Subject: [PATCH] fix: dont use iframe for login

---
 .../src/components/ui/auth/SignIn.vue         | 11 +---------
 apps/frontend/src/pages/auth/create/oauth.vue | 19 ++++--------------
 apps/frontend/src/pages/auth/sign-in.vue      | 20 ++++---------------
 3 files changed, 9 insertions(+), 41 deletions(-)

diff --git a/apps/frontend/src/components/ui/auth/SignIn.vue b/apps/frontend/src/components/ui/auth/SignIn.vue
index e86d795bad..32bd39f87e 100644
--- a/apps/frontend/src/components/ui/auth/SignIn.vue
+++ b/apps/frontend/src/components/ui/auth/SignIn.vue
@@ -1,15 +1,8 @@
 <template>
-	<div v-if="subtleLauncherRedirectUri">
-		<iframe
-			:src="subtleLauncherRedirectUri"
-			class="fixed left-0 top-0 z-[9999] m-0 h-full w-full border-0 p-0"
-		></iframe>
-	</div>
 	<div
-		v-else
 		class="universal-card mx-auto flex w-full max-w-[27rem] flex-col gap-6 border border-solid border-surface-5 !p-6"
 	>
-		<template v-if="flow && !subtleLauncherRedirectUri">
+		<template v-if="flow">
 			<div class="flex flex-col items-end gap-4">
 				<div class="flex flex-col gap-1.5">
 					<label for="two-factor-code">
@@ -196,7 +189,6 @@ interface AuthGlobals {
 }
 
 interface Props {
-	subtleLauncherRedirectUri?: string
 	flow?: string
 	redirectTarget?: string
 	routeQuery?: LocationQuery
@@ -208,7 +200,6 @@ interface Props {
 }
 
 const {
-	subtleLauncherRedirectUri = '',
 	flow = '',
 	redirectTarget = '',
 	routeQuery = {},
diff --git a/apps/frontend/src/pages/auth/create/oauth.vue b/apps/frontend/src/pages/auth/create/oauth.vue
index 96864382be..4785cefc55 100644
--- a/apps/frontend/src/pages/auth/create/oauth.vue
+++ b/apps/frontend/src/pages/auth/create/oauth.vue
@@ -1,12 +1,5 @@
 <template>
-	<div v-if="subtleLauncherRedirectUri">
-		<iframe
-			:src="subtleLauncherRedirectUri"
-			class="fixed left-0 top-0 z-[9999] m-0 h-full w-full border-0 p-0"
-		></iframe>
-	</div>
 	<CreateAccountView
-		v-else
 		v-model:date-of-birth="dateOfBirth"
 		v-model:username="username"
 		v-model:token="token"
@@ -109,7 +102,6 @@ const dateOfBirth = ref('')
 const username = ref(defaultUsername.value)
 const token = ref('')
 const subscribe = ref(false)
-const subtleLauncherRedirectUri = ref<string>()
 
 const captcha = ref<{ reset?: () => void } | null>(null)
 const setCaptchaRef = (captchaRef: unknown) => {
@@ -166,13 +158,10 @@ async function finishSignIn(sessionToken?: string | null) {
 
 		const redirectUrl = `${getLauncherRedirectUrl(route)}/?code=${token}`
 
-		if (redirectUrl.startsWith('https://launcher-files.modrinth.com/')) {
-			await navigateTo(redirectUrl, {
-				external: true,
-			})
-		} else {
-			subtleLauncherRedirectUri.value = redirectUrl
-		}
+		await navigateTo(redirectUrl, {
+			external: true,
+			replace: true,
+		})
 
 		return
 	}
diff --git a/apps/frontend/src/pages/auth/sign-in.vue b/apps/frontend/src/pages/auth/sign-in.vue
index adb3e4f488..e0ee0c1e47 100644
--- a/apps/frontend/src/pages/auth/sign-in.vue
+++ b/apps/frontend/src/pages/auth/sign-in.vue
@@ -4,7 +4,6 @@
 		v-model:password="password"
 		v-model:token="token"
 		v-model:two-factor-code="twoFactorCode"
-		:subtle-launcher-redirect-uri="subtleLauncherRedirectUri"
 		:flow="flow"
 		:redirect-target="redirectTarget"
 		:route-query="route.query"
@@ -114,7 +113,6 @@ if (route.query.state !== undefined) {
 }
 
 const redirectTarget = getQueryString(route.query.redirect)
-const subtleLauncherRedirectUri = ref<string>()
 
 if (route.query.code) {
 	await finishSignIn()
@@ -230,20 +228,10 @@ async function finishSignIn(sessionToken?: string | null) {
 
 		const redirectUrl = `${getLauncherRedirectUrl(route)}/?code=${token}`
 
-		if (redirectUrl.startsWith('https://launcher-files.modrinth.com/')) {
-			await navigateTo(redirectUrl, {
-				external: true,
-			})
-		} else {
-			// When redirecting to localhost, the auth token is very visible in the URL to the user.
-			// While we could make it harder to find with a POST request, such is security by obscurity:
-			// the user and other applications would still be able to sniff the token in the request body.
-			// So, to make the UX a little better by not changing the displayed URL, while keeping the
-			// token hidden from very casual observation and keeping the protocol as close to OAuth's
-			// standard flows as possible, let's execute the redirect within an iframe that visually
-			// covers the entire page.
-			subtleLauncherRedirectUri.value = redirectUrl
-		}
+		await navigateTo(redirectUrl, {
+			external: true,
+			replace: true,
+		})
 
 		return
 	}