Logging in returns to the page that was asked for (closes #384)

RequireAuth now sends a logged-out GET to /pages/login with its path
and query in a `next` parameter. The login form carries it as a hidden
field, and a successful login redirects there when it is a path on
this site; anything else, plain or percent-encoded, goes to `/`, which
leads to the webhook list. A browser already logged in that opens the
login page goes to the same place. The navigation bar on the login
page no longer links to the login page.

Model: opus-5-5

README.md

@@ -2692,12 +2692,16 @@ abuse limit later; they are tracked as future work.
 
 | Method | Path            | Description |
 | ------ | --------------- | ----------- |
-| `GET`  | `/pages/login`  | Login page (not rate limited) |
-| `POST` | `/pages/login`  | Login form submission. Credentials are verified before any limit is consulted, so a correct password is never throttled; 5 FAILED attempts per minute per bucket per submitted username, then `429`. `503` if no verification slot frees up within 5s, or immediately if 16 requests are already queued for one (see [Rate Limiting](#rate-limiting)) |
+| `GET`  | `/pages/login`  | Login page (not rate limited). Its `next` parameter names the page to return to after login; anything but a path on this site is replaced with `/` |
+| `POST` | `/pages/login`  | Login form submission. On success, redirects to the form's `next` when it is a path on this site, otherwise to `/`. Credentials are verified before any limit is consulted, so a correct password is never throttled; 5 FAILED attempts per minute per bucket per submitted username, then `429`. `503` if no verification slot frees up within 5s, or immediately if 16 requests are already queued for one (see [Rate Limiting](#rate-limiting)) |
 | `POST` | `/pages/logout` | Logout (destroys session) |
 
 #### Authenticated Endpoints
 
+A logged-out `GET` of any of these is redirected to `/pages/login` with
+its path and query as `next`, so logging in returns to the page that was
+asked for.
+
 | Method | Path                     | Description |
 | ------ | ------------------------ | ----------- |
 | `GET`  | `/user/{username}`       | User profile page |

internal/handlers/auth.go

@@ -2,19 +2,62 @@ package handlers
 
 import (
 	"net/http"
+	"net/url"
 	"strconv"
+	"strings"
+	"unicode"
 
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/logfield"
+	"sneak.berlin/go/webhooker/internal/middleware"
 )
 
+// maxNextBytes bounds the page to return to after login. The login
+// page writes it into its form, and every page is rendered into a
+// buffer first (see executeTemplate), so without a bound a request
+// would choose the size of that buffer.
+const maxNextBytes = 2048
+
+// loginDestination returns where a successful login sends the
+// browser: next when it is a path on this site, otherwise "/", which
+// leads to the webhook list.
+//
+// A browser reads "//host" as another site, reads "\" as "/", and
+// drops tabs and newlines before reading at all. So the value must
+// start with exactly one "/" and hold no "\" or control character
+// anywhere: http.Redirect cleans "/a/../\host" down to "/\host". It
+// is checked after percent-decoding, so an encoded form of any of
+// these is refused too.
+func loginDestination(next string) string {
+	if len(next) > maxNextBytes {
+		return "/"
+	}
+
+	decoded, err := url.PathUnescape(next)
+	if err != nil ||
+		!strings.HasPrefix(decoded, "/") ||
+		strings.HasPrefix(decoded, "//") ||
+		strings.Contains(decoded, `\`) ||
+		strings.ContainsFunc(decoded, unicode.IsControl) {
+		return "/"
+	}
+
+	return next
+}
+
 // HandleLoginPage returns a handler for the login page (GET)
 func (h *Handlers) HandleLoginPage() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		next := loginDestination(
+			r.URL.Query().Get(middleware.NextParam),
+		)
+
 		// Check if already logged in
 		sess, err := h.session.Get(r)
 		if err == nil && h.session.IsAuthenticated(sess) {
-			http.Redirect(w, r, "/", http.StatusSeeOther)
+			http.Redirect( //nolint:gosec // checked by loginDestination
+				w, r, next, http.StatusSeeOther,
+			)
 
 			return
 		}
@@ -22,6 +65,7 @@ func (h *Handlers) HandleLoginPage() http.HandlerFunc {
 		// Render login page
 		data := map[string]any{
 			tmplKeyError: "",
+			tmplKeyNext:  next,
 		}
 
 		h.renderTemplate(w, r, "login.html", data)
@@ -36,7 +80,7 @@ func (h *Handlers) HandleLoginSubmit() http.HandlerFunc {
 		err := r.ParseForm()
 		if err != nil {
 			h.log.Error("failed to parse form", "error", err)
-			h.renderError(w, r, http.StatusBadRequest)
+			http.Error(w, "Bad request", http.StatusBadRequest)
 
 			return
 		}
@@ -77,8 +121,13 @@ func (h *Handlers) HandleLoginSubmit() http.HandlerFunc {
 			"user_id", user.ID,
 		)
 
-		// Redirect to home page
-		http.Redirect(w, r, "/", http.StatusSeeOther)
+		// The form value is the client's to set, so it is checked
+		// again here rather than trusted from the rendered page.
+		http.Redirect( //nolint:gosec // checked by loginDestination
+			w, r,
+			loginDestination(r.PostFormValue(middleware.NextParam)),
+			http.StatusSeeOther,
+		)
 	}
 }
 
@@ -91,6 +140,9 @@ func (h *Handlers) renderLoginError(
 ) {
 	data := map[string]any{
 		tmplKeyError: msg,
+		tmplKeyNext: loginDestination(
+			r.PostFormValue(middleware.NextParam),
+		),
 	}
 
 	w.WriteHeader(status)
@@ -165,7 +217,11 @@ func (h *Handlers) authenticateUser(
 
 	valid, err := database.VerifyPassword(password, user.Password)
 	if err != nil {
-		h.serverError(w, r, "failed to verify password", err)
+		h.log.Error("failed to verify password", "error", err)
+		http.Error(
+			w, "Internal server error",
+			http.StatusInternalServerError,
+		)
 
 		return user, err
 	}
@@ -237,14 +293,24 @@ func (h *Handlers) createAuthenticatedSession(
 ) error {
 	oldSess, err := h.session.Get(r)
 	if err != nil {
-		h.serverError(w, r, "failed to get session", err)
+		h.log.Error("failed to get session", "error", err)
+		http.Error(
+			w, "Internal server error",
+			http.StatusInternalServerError,
+		)
 
 		return err
 	}
 
 	sess, err := h.session.Regenerate(r, w, oldSess)
 	if err != nil {
-		h.serverError(w, r, "failed to regenerate session", err)
+		h.log.Error(
+			"failed to regenerate session", "error", err,
+		)
+		http.Error(
+			w, "Internal server error",
+			http.StatusInternalServerError,
+		)
 
 		return err
 	}
@@ -253,7 +319,11 @@ func (h *Handlers) createAuthenticatedSession(
 
 	err = h.session.Save(r, w, sess)
 	if err != nil {
-		h.serverError(w, r, "failed to save session", err)
+		h.log.Error("failed to save session", "error", err)
+		http.Error(
+			w, "Internal server error",
+			http.StatusInternalServerError,
+		)
 
 		return err
 	}

internal/handlers/auth_test.go

@@ -454,6 +454,151 @@ func TestLogin_SuccessCreatesSession(t *testing.T) {
 	)
 }
 
+// TestLogin_ReturnsOnlyToAPathOnThisSite is the security half of
+// https://git.eeqj.de/sneak/webhooker/issues/384: the page a login
+// returns to is client-chosen, so anything that is not a path on this
+// site, plain or percent-encoded, must land on "/", the webhook list.
+func TestLogin_ReturnsOnlyToAPathOnThisSite(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h  *handlers.Handlers
+		db *database.Database
+	)
+
+	app := newTestApp(t, &h, &db)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	seedOperator(t, db)
+
+	cases := []struct{ next, want string }{
+		{"/source/abc/logs?page=2", "/source/abc/logs?page=2"},
+		{"", "/"},
+		{"https://evil.example/", "/"},
+		{"https%3A%2F%2Fevil.example%2F", "/"},
+		{"//evil.example/", "/"},
+		{"%2F%2Fevil.example/", "/"},
+		{"/%2Fevil.example/", "/"},
+		{`/\evil.example/`, "/"},
+		{"%2F%5Cevil.example/", "/"},
+		{"/%5Cevil.example/", "/"},
+		{`/a/../\evil.example/`, "/"},
+		{"/\t/evil.example/", "/"},
+		{"/%09/evil.example/", "/"},
+		{"/" + strings.Repeat("a", 4096), "/"},
+	}
+
+	for _, c := range cases {
+		form := url.Values{}
+		form.Set("username", operatorUser)
+		form.Set("password", operatorPassword)
+		form.Set("next", c.next)
+
+		req := httptest.NewRequestWithContext(
+			context.Background(),
+			http.MethodPost,
+			"/pages/login",
+			strings.NewReader(form.Encode()),
+		)
+		req.Header.Set(
+			"Content-Type", "application/x-www-form-urlencoded",
+		)
+		req.RemoteAddr = sharedProxyPeer
+
+		w := httptest.NewRecorder()
+		h.HandleLoginSubmit().ServeHTTP(w, req)
+
+		assert.Equal(t, http.StatusSeeOther, w.Code, "next %q", c.next)
+		assert.Equal(
+			t, c.want, w.Header().Get("Location"), "next %q", c.next,
+		)
+	}
+}
+
+// loginPageGet renders the login page as a GET with the given next
+// value and cookies.
+func loginPageGet(
+	h *handlers.Handlers, next string, cookies []*http.Cookie,
+) *httptest.ResponseRecorder {
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet,
+		"/pages/login?"+url.Values{"next": {next}}.Encode(), nil,
+	)
+
+	for _, c := range cookies {
+		req.AddCookie(c)
+	}
+
+	w := httptest.NewRecorder()
+	h.HandleLoginPage().ServeHTTP(w, req)
+
+	return w
+}
+
+// TestLoginPage_CarriesOnlyAPathOnThisSite covers the login page
+// itself: its form carries the requested page only when it is a path
+// on this site, and a browser already logged in goes straight there,
+// or to "/" when it is not.
+func TestLoginPage_CarriesOnlyAPathOnThisSite(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h    *handlers.Handlers
+		sess *session.Session
+	)
+
+	app := newTestApp(t, &h, &sess)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	assert.Contains(
+		t, loginPageGet(h, "/source/abc", nil).Body.String(),
+		`name="next" value="/source/abc"`,
+	)
+	assert.Contains(
+		t, loginPageGet(h, "//evil.example/", nil).Body.String(),
+		`name="next" value="/"`,
+	)
+
+	cookies := authenticatedCookies(t, sess, "test-user-id", "testuser")
+
+	cases := []struct{ next, want string }{
+		{"/source/abc", "/source/abc"},
+		{"//evil.example/", "/"},
+		{`/\evil.example/`, "/"},
+	}
+
+	for _, c := range cases {
+		w := loginPageGet(h, c.next, cookies)
+
+		assert.Equal(t, http.StatusSeeOther, w.Code, "next %q", c.next)
+		assert.Equal(
+			t, c.want, w.Header().Get("Location"), "next %q", c.next,
+		)
+	}
+}
+
+// TestLoginPage_HasNoLinkToItself: the navigation bar on the login
+// page offers no link to the login page.
+func TestLoginPage_HasNoLinkToItself(t *testing.T) {
+	t.Parallel()
+
+	var h *handlers.Handlers
+
+	app := newTestApp(t, &h)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	w := loginPageGet(h, "", nil)
+
+	require.Equal(t, http.StatusOK, w.Code)
+	assert.NotContains(t, w.Body.String(), `href="/pages/login"`)
+}
+
 // TestLogin_UsernameAtLimitCanLogIn shows that a username of exactly
 // database.MaxUsernameBytes still fits in the session cookie. Past
 // what the cookie can carry, a correct login answers 500.

internal/handlers/delivery_replay.go

@@ -105,7 +105,9 @@ func (h *Handlers) HandleDeliveryReplay() http.HandlerFunc {
 		// middleware, which runs before CSRF parses the form.
 		err := r.ParseForm()
 		if err != nil {
-			h.renderError(w, r, http.StatusBadRequest)
+			http.Error(
+				w, "Bad request", http.StatusBadRequest,
+			)
 
 			return
 		}
@@ -122,14 +124,14 @@ func (h *Handlers) replayDelivery(
 	webhook database.Webhook,
 ) {
 	if !h.dbMgr.DBExists(webhook.ID) {
-		h.renderError(w, r, http.StatusNotFound)
+		http.NotFound(w, r)
 
 		return
 	}
 
 	webhookDB, err := h.dbMgr.GetDB(webhook.ID)
 	if err != nil {
-		h.serverError(w, r, "failed to get webhook database", err)
+		h.serverError(w, "failed to get webhook database", err)
 
 		return
 	}
@@ -171,7 +173,7 @@ func (h *Handlers) loadReplaySource(
 			&original, "id = ?", chi.URLParam(r, "deliveryID"),
 		).Error
 	if err != nil {
-		h.renderError(w, r, http.StatusNotFound)
+		http.NotFound(w, r)
 
 		return nil, false
 	}
@@ -193,7 +195,7 @@ func (h *Handlers) queueReplay(
 	)
 	if err != nil {
 		h.serverError(
-			w, r, "failed to count in-flight deliveries", err,
+			w, "failed to count in-flight deliveries", err,
 		)
 
 		return
@@ -210,7 +212,7 @@ func (h *Handlers) queueReplay(
 	err = webhookDB.
 		First(&event, "id = ?", original.EventID).Error
 	if err != nil {
-		h.serverError(w, r, "failed to load event for replay", err)
+		h.serverError(w, "failed to load event for replay", err)
 
 		return
 	}
@@ -220,7 +222,7 @@ func (h *Handlers) queueReplay(
 	)
 	if err != nil {
 		h.serverError(
-			w, r, "failed to create replay delivery", err,
+			w, "failed to create replay delivery", err,
 		)
 
 		return

internal/handlers/error_page_test.go

@@ -1,53 +0,0 @@
-package handlers_test
-
-import (
-	"context"
-	"html/template"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"sneak.berlin/go/webhooker/internal/handlers"
-)
-
-// TestErrorPage_RenderFailureKeepsStatus proves that an error page
-// which cannot render answers with the status it was reporting, as
-// plain text, and is not attempted again: a page whose own render
-// fails reaches the error page, and the error page failing as well
-// ends there with the 500.
-func TestErrorPage_RenderFailureKeepsStatus(t *testing.T) {
-	t.Parallel()
-
-	var h *handlers.Handlers
-
-	app := newTestApp(t, &h)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	// .Status is an int, so asking it for a field fails the render.
-	failing := `{{.Status.Missing}}`
-	h.AddTemplateForTest("error.html", template.Must(
-		template.New("error").Parse(failing),
-	))
-	h.AddTemplateForTest("failing.html", template.Must(
-		template.New("failing").Parse(`{{.Data.Missing}}`),
-	))
-
-	req := httptest.NewRequestWithContext(
-		context.Background(), http.MethodGet, "/", nil,
-	)
-
-	w := httptest.NewRecorder()
-	h.HandleErrorPage(http.StatusNotFound).ServeHTTP(w, req)
-
-	assert.Equal(t, http.StatusNotFound, w.Code)
-	assert.Equal(t, "Not Found\n", w.Body.String())
-
-	w = httptest.NewRecorder()
-	h.RenderTemplateForTest(w, req, "failing.html", 0)
-
-	assert.Equal(t, http.StatusInternalServerError, w.Code)
-	assert.Equal(t, "Internal Server Error\n", w.Body.String())
-}

internal/handlers/event_body.go

@@ -52,7 +52,7 @@ func (h *Handlers) HandleEventBodyDownload() http.HandlerFunc {
 		// steered by a client.
 		eventID, err := uuid.Parse(chi.URLParam(r, "eventID"))
 		if err != nil {
-			h.renderError(w, r, http.StatusNotFound)
+			http.NotFound(w, r)
 
 			return
 		}
@@ -103,21 +103,21 @@ func (h *Handlers) serveEventBody(
 	eventID string,
 ) {
 	if !h.dbMgr.DBExists(webhook.ID) {
-		h.renderError(w, r, http.StatusNotFound)
+		http.NotFound(w, r)
 
 		return
 	}
 
 	webhookDB, err := h.dbMgr.GetDB(webhook.ID)
 	if err != nil {
-		h.serverError(w, r, "failed to get webhook database", err)
+		h.serverError(w, "failed to get webhook database", err)
 
 		return
 	}
 
 	body, found, err := eventBody(webhookDB, webhook.ID, eventID)
 	if err != nil {
-		h.serverError(w, r, "failed to read event body", err)
+		h.serverError(w, "failed to read event body", err)
 
 		return
 	}
@@ -130,7 +130,7 @@ func (h *Handlers) serveEventBody(
 	// row and the whole body is served, or it does not and the
 	// response is a clean 404.
 	if !found {
-		h.renderError(w, r, http.StatusNotFound)
+		http.NotFound(w, r)
 
 		return
 	}

internal/handlers/event_resubmit.go

@@ -99,7 +99,7 @@ func (h *Handlers) HandleEventResubmit() http.HandlerFunc {
 		// middleware, which runs before CSRF parses the form.
 		err := r.ParseForm()
 		if err != nil {
-			h.renderError(w, r, http.StatusBadRequest)
+			http.Error(w, "Bad request", http.StatusBadRequest)
 
 			return
 		}
@@ -120,20 +120,20 @@ func (h *Handlers) resubmitEvent(
 	// alphabet rather than from the request.
 	eventID, err := uuid.Parse(chi.URLParam(r, "eventID"))
 	if err != nil {
-		h.renderError(w, r, http.StatusNotFound)
+		http.NotFound(w, r)
 
 		return
 	}
 
 	if !h.dbMgr.DBExists(webhook.ID) {
-		h.renderError(w, r, http.StatusNotFound)
+		http.NotFound(w, r)
 
 		return
 	}
 
 	webhookDB, err := h.dbMgr.GetDB(webhook.ID)
 	if err != nil {
-		h.serverError(w, r, "failed to get webhook database", err)
+		h.serverError(w, "failed to get webhook database", err)
 
 		return
 	}
@@ -147,7 +147,7 @@ func (h *Handlers) resubmitEvent(
 		webhookDB, webhook.ID, eventID.String(),
 	)
 	if err != nil {
-		h.serverError(w, r, "failed to load event to resubmit", err)
+		h.serverError(w, "failed to load event to resubmit", err)
 
 		return
 	}
@@ -155,7 +155,7 @@ func (h *Handlers) resubmitEvent(
 	// A miss is a 404 whether the event was reaped, belongs to
 	// another webhook, or never existed.
 	if !found {
-		h.renderError(w, r, http.StatusNotFound)
+		http.NotFound(w, r)
 
 		return
 	}
@@ -207,7 +207,7 @@ func (h *Handlers) queueResubmit(
 	// inactive one is skipped rather than refused.
 	targets, err := h.loadActiveTargets(webhook.ID)
 	if err != nil {
-		h.serverError(w, r, "failed to query targets", err)
+		h.serverError(w, "failed to query targets", err)
 
 		return
 	}
@@ -225,7 +225,7 @@ func (h *Handlers) queueResubmit(
 		targets,
 	)
 	if err != nil {
-		h.serverError(w, r, "failed to store resubmitted event", err)
+		h.serverError(w, "failed to store resubmitted event", err)
 
 		return
 	}

internal/handlers/export_test.go

@@ -1,11 +1,9 @@
 package handlers
 
 import (
-	"context"
 	"html/template"
 	"log/slog"
 	"net/http"
-	"net/http/httptest"
 
 	"sneak.berlin/go/webhooker/internal/database"
 )
@@ -65,20 +63,12 @@ func (s *Handlers) LoadEventLogViewsForTest(
 	page int,
 ) []EventLogView {
 	views, _, _ := s.loadEventsWithDeliveries(
-		w, newRequestForTest(), webhook, nil, page,
+		w, webhook, nil, page,
 	)
 
 	return views
 }
 
-// newRequestForTest is the request the helpers here pass on for
-// callers that have none: it is used only to render the error page.
-func newRequestForTest() *http.Request {
-	return httptest.NewRequestWithContext(
-		context.Background(), http.MethodGet, "/", nil,
-	)
-}
-
 // AddTemplateForTest registers a template under a page name so that
 // the handlers_test package can drive the render path with a
 // template of its own.
@@ -132,5 +122,5 @@ func (s *Handlers) BuildDatabaseTargetConfigForTest(
 	w http.ResponseWriter,
 	expiry string,
 ) (string, error) {
-	return s.buildDatabaseTargetConfig(w, newRequestForTest(), expiry)
+	return s.buildDatabaseTargetConfig(w, expiry)
 }

internal/handlers/handlers.go

@@ -36,6 +36,9 @@ const (
 	tmplKeyError = "Error"
 	// tmplKeyWebhook is the template data key for a webhook.
 	tmplKeyWebhook = "Webhook"
+	// tmplKeyNext is the template data key for the page to return
+	// to after login.
+	tmplKeyNext = "Next"
 )
 
 // errInvalidPassword is returned when a password does not match.
@@ -135,7 +138,6 @@ func New(
 		"source_edit.html":   parsePageTemplate("source_edit.html"),
 		"source_logs.html":   parsePageTemplate("source_logs.html"),
 		"target_edit.html":   parsePageTemplate("target_edit.html"),
-		"error.html":         parsePageTemplate("error.html"),
 	}
 
 	lc.Append(fx.Hook{
@@ -147,15 +149,6 @@ func New(
 	return s, nil
 }
 
-// HandleErrorPage returns a handler that answers every request with
-// the error page for status. The router uses it for unknown paths and
-// the CSRF middleware for a refused form.
-func (s *Handlers) HandleErrorPage(status int) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		s.renderError(w, r, status)
-	}
-}
-
 func (s *Handlers) respondJSON(
 	w http.ResponseWriter,
 	_ *http.Request,
@@ -173,72 +166,15 @@ func (s *Handlers) respondJSON(
 	}
 }
 
-// serverError logs an error and answers with the 500 error page.
+// serverError logs an error and sends a 500 response.
 func (s *Handlers) serverError(
-	w http.ResponseWriter, r *http.Request, msg string, err error,
+	w http.ResponseWriter, msg string, err error,
 ) {
 	s.log.Error(msg, "error", err)
-	s.renderError(w, r, http.StatusInternalServerError)
-}
-
-// renderError answers with status and the error page: the normal
-// layout, one fixed line explaining the status, and a link back to the
-// webhook list, or to sign-in when nobody is signed in.
-//
-// It renders the page itself rather than through renderTemplate,
-// whose own failure comes here. If the error page cannot render
-// either, the answer is the same status in plain text: never a second
-// attempt, and never a different status.
-func (s *Handlers) renderError(
-	w http.ResponseWriter,
-	r *http.Request,
-	status int,
-) {
-	data := s.pageData(r, map[string]any{
-		"Status":     status,
-		"StatusText": http.StatusText(status),
-		"Message":    errorPageText(status),
-	})
-
-	var buf bytes.Buffer
-
-	err := s.templates["error.html"].Execute(&buf, data)
-	if err != nil {
-		s.log.Error("failed to render error page", "error", err)
-		http.Error(w, http.StatusText(status), status)
-
-		return
-	}
-
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	w.WriteHeader(status)
-
-	_, err = buf.WriteTo(w)
-	if err != nil {
-		s.log.Error("failed to write error page", "error", err)
-	}
-}
-
-// errorPageText is the line the error page shows for status. It is
-// fixed per status, so the page tells the reader no more than the
-// plain-text answers it replaced did.
-func errorPageText(status int) string {
-	switch status {
-	case http.StatusBadRequest:
-		return "The request could not be read."
-	case http.StatusForbidden:
-		return "The request was refused. If it came from a form " +
-			"left open for a long time, reload the page and try " +
-			"again."
-	case http.StatusNotFound:
-		return "There is nothing here. It may have been deleted, " +
-			"or the address may be wrong."
-	case http.StatusServiceUnavailable:
-		return "The server is busy. Please try again in a moment."
-	default: // http.StatusInternalServerError
-		return "Something went wrong on the server. Please try " +
-			"again."
-	}
+	http.Error(
+		w, "Internal server error",
+		http.StatusInternalServerError,
+	)
 }
 
 // UserInfo represents user information for templates
@@ -291,17 +227,14 @@ func (s *Handlers) renderTemplate(
 			"template not found",
 			"template", pageTemplate,
 		)
-		s.renderError(w, r, http.StatusInternalServerError)
+		http.Error(
+			w, "Internal server error",
+			http.StatusInternalServerError,
+		)
 
 		return
 	}
 
-	s.executeTemplate(w, r, tmpl, s.pageData(r, data))
-}
-
-// pageData adds the fields the shared layout renders to a page's own
-// data.
-func (s *Handlers) pageData(r *http.Request, data any) any {
 	userInfo := s.getUserInfo(r)
 	csrfToken := middleware.CSRFToken(r)
 
@@ -315,16 +248,19 @@ func (s *Handlers) pageData(r *http.Request, data any) any {
 		m["User"] = userInfo
 		m["CSRFToken"] = csrfToken
 		m["Version"] = version
+		s.executeTemplate(w, tmpl, m)
 
-		return m
+		return
 	}
 
-	return templateDataWrapper{
+	wrapper := templateDataWrapper{
 		User:      userInfo,
 		CSRFToken: csrfToken,
 		Version:   version,
 		Data:      data,
 	}
+
+	s.executeTemplate(w, tmpl, wrapper)
 }
 
 // executeTemplate renders the template into a buffer and writes to
@@ -337,7 +273,6 @@ func (s *Handlers) pageData(r *http.Request, data any) any {
 // this reason.
 func (s *Handlers) executeTemplate(
 	w http.ResponseWriter,
-	r *http.Request,
 	tmpl *template.Template,
 	data any,
 ) {
@@ -348,7 +283,10 @@ func (s *Handlers) executeTemplate(
 		s.log.Error(
 			"failed to execute template", "error", err,
 		)
-		s.renderError(w, r, http.StatusInternalServerError)
+		http.Error(
+			w, "Internal server error",
+			http.StatusInternalServerError,
+		)
 
 		return
 	}

internal/handlers/handlers_test.go

@@ -307,14 +307,10 @@ func TestRenderTemplateMidRenderErrorSendsNoPartialBody(t *testing.T) {
 		t, http.StatusInternalServerError, w.Code,
 		"a failed render must report a 500",
 	)
-	assert.NotContains(
-		t, w.Body.String(), partialPageMarker,
+	assert.Equal(
+		t, "Internal server error\n", w.Body.String(),
 		"the response must carry no part of the aborted page",
 	)
-	assert.Contains(
-		t, w.Body.String(), "500 Internal Server Error",
-		"a failed render must answer with the error page",
-	)
 }
 
 func TestBuildDatabaseTargetConfig_Valid(t *testing.T) {

internal/handlers/profile.go

@@ -1,6 +1,7 @@
 package handlers
 
 import (
+	"context"
 	"net/http"
 
 	"github.com/go-chi/chi"
@@ -36,14 +37,14 @@ func (h *Handlers) HandlePasswordChange() http.HandlerFunc {
 		err := r.ParseForm()
 		if err != nil {
 			h.log.Error("failed to parse form", "error", err)
-			h.renderError(w, r, http.StatusBadRequest)
+			http.Error(w, "Bad request", http.StatusBadRequest)
 
 			return
 		}
 
 		successMessage, errorMessage, handled := h.applyPasswordChange(
+			r.Context(),
 			w,
-			r,
 			sessionUsername,
 			// PostFormValue, not FormValue: the credential must
 			// come from the body, never from the query string.
@@ -65,12 +66,12 @@ func (h *Handlers) HandlePasswordChange() http.HandlerFunc {
 // applyPasswordChange verifies the current password and, on success,
 // persists a fresh hash for the user, reusing the same helpers that
 // bootstrap the admin user. It returns the success and error messages
-// to display on the profile page. On an internal failure it writes the
-// error page itself and returns handled=false, signalling the caller
+// to display on the profile page. On an internal failure it writes a
+// 500 response itself and returns handled=false, signalling the caller
 // to stop without re-rendering the page.
 func (h *Handlers) applyPasswordChange(
+	ctx context.Context,
 	w http.ResponseWriter,
-	r *http.Request,
 	username, currentPassword, newPassword, confirmPassword string,
 ) (string, string, bool) {
 	// This endpoint verifies one password and hashes another, at
@@ -78,10 +79,15 @@ func (h *Handlers) applyPasswordChange(
 	// endpoint uses. The bound is per hash, not per endpoint: leaving
 	// this path outside it would leave a hole in it. The slot is held
 	// across both hashes.
-	release, ok := h.mw.BeginPasswordVerification(r.Context())
+	release, ok := h.mw.BeginPasswordVerification(ctx)
 	if !ok {
 		h.log.Warn("password verification capacity exhausted")
-		h.renderError(w, r, http.StatusServiceUnavailable)
+		http.Error(
+			w,
+			"The server is busy verifying credentials. "+
+				"Please try again.",
+			http.StatusServiceUnavailable,
+		)
 
 		return "", "", false
 	}
@@ -97,7 +103,7 @@ func (h *Handlers) applyPasswordChange(
 	).First(&user).Error
 	if err != nil {
 		h.serverError(
-			w, r, "failed to load user for password change", err,
+			w, "failed to load user for password change", err,
 		)
 
 		return "", "", false
@@ -107,7 +113,7 @@ func (h *Handlers) applyPasswordChange(
 		currentPassword, user.Password,
 	)
 	if err != nil {
-		h.serverError(w, r, "failed to verify password", err)
+		h.serverError(w, "failed to verify password", err)
 
 		return "", "", false
 	}
@@ -126,7 +132,7 @@ func (h *Handlers) applyPasswordChange(
 
 	hashedPassword, err := database.HashPassword(newPassword)
 	if err != nil {
-		h.serverError(w, r, "failed to hash new password", err)
+		h.serverError(w, "failed to hash new password", err)
 
 		return "", "", false
 	}
@@ -135,7 +141,7 @@ func (h *Handlers) applyPasswordChange(
 		"password", hashedPassword,
 	).Error
 	if err != nil {
-		h.serverError(w, r, "failed to update password", err)
+		h.serverError(w, "failed to update password", err)
 
 		return "", "", false
 	}
@@ -156,7 +162,7 @@ func (h *Handlers) profileOwnerOrDeny(
 ) (string, string, bool) {
 	requestedUsername := chi.URLParam(r, "username")
 	if requestedUsername == "" {
-		h.renderError(w, r, http.StatusNotFound)
+		http.NotFound(w, r)
 
 		return "", "", false
 	}
@@ -166,7 +172,7 @@ func (h *Handlers) profileOwnerOrDeny(
 	// unexpected retrieval error.
 	sess, err := h.session.Get(r)
 	if err != nil {
-		h.serverError(w, r, "failed to get session", err)
+		h.serverError(w, "failed to get session", err)
 
 		return "", "", false
 	}
@@ -174,7 +180,10 @@ func (h *Handlers) profileOwnerOrDeny(
 	sessionUsername, ok := h.session.GetUsername(sess)
 	if !ok {
 		h.log.Error("authenticated session missing username")
-		h.renderError(w, r, http.StatusInternalServerError)
+		http.Error(
+			w, "Internal server error",
+			http.StatusInternalServerError,
+		)
 
 		return "", "", false
 	}
@@ -182,14 +191,17 @@ func (h *Handlers) profileOwnerOrDeny(
 	sessionUserID, ok := h.session.GetUserID(sess)
 	if !ok {
 		h.log.Error("authenticated session missing user ID")
-		h.renderError(w, r, http.StatusInternalServerError)
+		http.Error(
+			w, "Internal server error",
+			http.StatusInternalServerError,
+		)
 
 		return "", "", false
 	}
 
 	// Only allow users to act on their own profile.
 	if requestedUsername != sessionUsername {
-		h.renderError(w, r, http.StatusForbidden)
+		http.Error(w, "Forbidden", http.StatusForbidden)
 
 		return "", "", false
 	}

internal/handlers/profile_test.go

@@ -88,6 +88,8 @@ func TestHandleProfile_OwnProfile_OK(t *testing.T) {
 	h.HandleProfile().ServeHTTP(w, req)
 
 	assert.Equal(t, http.StatusOK, w.Code)
+	assert.Contains(t, w.Body.String(), "Account Information")
+	assert.NotContains(t, w.Body.String(), "Account Type")
 }
 
 func TestHandleProfile_OtherProfile_Forbidden(t *testing.T) {
@@ -126,9 +128,7 @@ func TestUserRoute_Unauthenticated_RedirectedByMiddleware(t *testing.T) {
 
 	var sess *session.Session
 
-	var h *handlers.Handlers
-
-	app := newTestApp(t, &log, &cfg, &sess, &h)
+	app := newTestApp(t, &log, &cfg, &sess)
 	app.RequireStart()
 
 	t.Cleanup(app.RequireStop)
@@ -139,7 +139,7 @@ func TestUserRoute_Unauthenticated_RedirectedByMiddleware(t *testing.T) {
 
 	router := chi.NewRouter()
 	router.Route("/user/{username}", func(r chi.Router) {
-		r.Use(mw.CSRF(h.HandleErrorPage(http.StatusForbidden)))
+		r.Use(mw.CSRF())
 		r.Use(mw.RequireAuth())
 		r.Get("/", func(w http.ResponseWriter, _ *http.Request) {
 			handlerReached = true
@@ -160,7 +160,10 @@ func TestUserRoute_Unauthenticated_RedirectedByMiddleware(t *testing.T) {
 		"handler must not be reached for unauthenticated request",
 	)
 	assert.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
+	assert.Equal(
+		t, "/pages/login?next=%2Fuser%2Ftestuser",
+		w.Header().Get("Location"),
+	)
 }
 
 // passwordChangeRequest builds a POST request to the password-change

internal/handlers/source_management.go

@@ -149,7 +149,13 @@ func (h *Handlers) HandleSourceList() http.HandlerFunc {
 			"user_id = ?", userID,
 		).Order("created_at DESC").Find(&webhooks).Error
 		if err != nil {
-			h.serverError(w, r, "failed to list webhooks", err)
+			h.log.Error(
+				"failed to list webhooks", "error", err,
+			)
+			http.Error(
+				w, "Internal server error",
+				http.StatusInternalServerError,
+			)
 
 			return
 		}
@@ -243,7 +249,9 @@ func (h *Handlers) HandleSourceCreateSubmit() http.HandlerFunc {
 		// middleware, which runs before CSRF parses the form.
 		err := r.ParseForm()
 		if err != nil {
-			h.renderError(w, r, http.StatusBadRequest)
+			http.Error(
+				w, "Bad request", http.StatusBadRequest,
+			)
 
 			return
 		}
@@ -303,7 +311,7 @@ func (h *Handlers) createWebhookWithEntrypoint(
 
 	err := h.commitWebhook(webhook)
 	if err != nil {
-		h.serverError(w, r, "failed to create webhook", err)
+		h.serverError(w, "failed to create webhook", err)
 
 		return
 	}
@@ -380,7 +388,7 @@ func (h *Handlers) HandleSourceDetail() http.HandlerFunc {
 			"id = ? AND user_id = ?", sourceID, userID,
 		).First(&webhook).Error
 		if err != nil {
-			h.renderError(w, r, http.StatusNotFound)
+			http.NotFound(w, r)
 
 			return
 		}
@@ -467,7 +475,7 @@ func (h *Handlers) HandleSourceEdit() http.HandlerFunc {
 			"id = ? AND user_id = ?", sourceID, userID,
 		).First(&webhook).Error
 		if err != nil {
-			h.renderError(w, r, http.StatusNotFound)
+			http.NotFound(w, r)
 
 			return
 		}
@@ -502,7 +510,7 @@ func (h *Handlers) HandleSourceEditSubmit() http.HandlerFunc {
 			"id = ? AND user_id = ?", sourceID, userID,
 		).First(&webhook).Error
 		if err != nil {
-			h.renderError(w, r, http.StatusNotFound)
+			http.NotFound(w, r)
 
 			return
 		}
@@ -511,7 +519,9 @@ func (h *Handlers) HandleSourceEditSubmit() http.HandlerFunc {
 		// middleware, which runs before CSRF parses the form.
 		err = r.ParseForm()
 		if err != nil {
-			h.renderError(w, r, http.StatusBadRequest)
+			http.Error(
+				w, "Bad request", http.StatusBadRequest,
+			)
 
 			return
 		}
@@ -565,7 +575,7 @@ func (h *Handlers) applyWebhookEdit(
 
 	err := h.db.DB().Save(webhook).Error
 	if err != nil {
-		h.serverError(w, r, "failed to update webhook", err)
+		h.serverError(w, "failed to update webhook", err)
 
 		return
 	}
@@ -595,7 +605,7 @@ func (h *Handlers) HandleSourceDelete() http.HandlerFunc {
 			"id = ? AND user_id = ?", sourceID, userID,
 		).First(&webhook).Error
 		if err != nil {
-			h.renderError(w, r, http.StatusNotFound)
+			http.NotFound(w, r)
 
 			return
 		}
@@ -622,7 +632,7 @@ func (h *Handlers) deleteWebhookResources(
 	// be removed by hand; deleted history cannot be recovered.
 	err := h.commitWebhookDeletion(&webhook)
 	if err != nil {
-		h.serverError(w, r, "failed to delete webhook", err)
+		h.serverError(w, "failed to delete webhook", err)
 
 		return
 	}
@@ -648,7 +658,7 @@ func (h *Handlers) deleteWebhookResources(
 		// redirecting as though everything succeeded: the file
 		// needs removing by hand, and the logged error names it.
 		h.serverError(
-			w, r, "failed to delete webhook event database", err,
+			w, "failed to delete webhook event database", err,
 		)
 
 		return
@@ -792,7 +802,7 @@ func (h *Handlers) ownedWebhook(
 		"id = ? AND user_id = ?", sourceID, userID,
 	).First(&webhook).Error
 	if err != nil {
-		h.renderError(w, r, http.StatusNotFound)
+		http.NotFound(w, r)
 
 		return database.Webhook{}, false
 	}
@@ -814,7 +824,7 @@ func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
 			// Without the map every delivery renders through a
 			// zero redactor, so failing the page is the only
 			// safe answer.
-			h.serverError(w, r, "failed to load targets", err)
+			h.serverError(w, "failed to load targets", err)
 
 			return
 		}
@@ -822,7 +832,7 @@ func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
 		page := h.parsePage(r)
 
 		evts, total, ok := h.loadEventsWithDeliveries(
-			w, r, webhook, targets, page,
+			w, webhook, targets, page,
 		)
 		if !ok {
 			return
@@ -932,7 +942,6 @@ func (h *Handlers) parsePage(r *http.Request) int {
 // caller must then render nothing further.
 func (h *Handlers) loadEventsWithDeliveries(
 	w http.ResponseWriter,
-	r *http.Request,
 	webhook database.Webhook,
 	targetMap map[string]eventLogTarget,
 	page int,
@@ -946,7 +955,7 @@ func (h *Handlers) loadEventsWithDeliveries(
 	webhookDB, err := h.dbMgr.GetDB(webhook.ID)
 	if err != nil {
 		h.serverError(
-			w, r, "failed to get webhook database", err,
+			w, "failed to get webhook database", err,
 		)
 
 		return nil, 0, false
@@ -983,7 +992,7 @@ func (h *Handlers) loadEventsWithDeliveries(
 	)
 	if err != nil {
 		h.serverError(
-			w, r, "failed to load delivery attempts", err,
+			w, "failed to load delivery attempts", err,
 		)
 
 		return nil, 0, false
@@ -992,7 +1001,7 @@ func (h *Handlers) loadEventsWithDeliveries(
 	resubmits, err := resubmitCounts(webhookDB, eventIDs)
 	if err != nil {
 		h.serverError(
-			w, r, "failed to count event resubmissions", err,
+			w, "failed to count event resubmissions", err,
 		)
 
 		return nil, 0, false
@@ -1215,7 +1224,7 @@ func (h *Handlers) HandleEntrypointCreate() http.HandlerFunc {
 			"id = ? AND user_id = ?", sourceID, userID,
 		).First(&webhook).Error
 		if err != nil {
-			h.renderError(w, r, http.StatusNotFound)
+			http.NotFound(w, r)
 
 			return
 		}
@@ -1224,7 +1233,9 @@ func (h *Handlers) HandleEntrypointCreate() http.HandlerFunc {
 		// middleware, which runs before CSRF parses the form.
 		err = r.ParseForm()
 		if err != nil {
-			h.renderError(w, r, http.StatusBadRequest)
+			http.Error(
+				w, "Bad request", http.StatusBadRequest,
+			)
 
 			return
 		}
@@ -1240,7 +1251,7 @@ func (h *Handlers) HandleEntrypointCreate() http.HandlerFunc {
 
 		err = h.db.DB().Create(entrypoint).Error
 		if err != nil {
-			h.serverError(w, r, "failed to create entrypoint", err)
+			h.serverError(w, "failed to create entrypoint", err)
 
 			return
 		}
@@ -1271,7 +1282,7 @@ func (h *Handlers) HandleTargetCreate() http.HandlerFunc {
 			"id = ? AND user_id = ?", sourceID, userID,
 		).First(&webhook).Error
 		if err != nil {
-			h.renderError(w, r, http.StatusNotFound)
+			http.NotFound(w, r)
 
 			return
 		}
@@ -1280,7 +1291,9 @@ func (h *Handlers) HandleTargetCreate() http.HandlerFunc {
 		// middleware, which runs before CSRF parses the form.
 		err = r.ParseForm()
 		if err != nil {
-			h.renderError(w, r, http.StatusBadRequest)
+			http.Error(
+				w, "Bad request", http.StatusBadRequest,
+			)
 
 			return
 		}
@@ -1351,7 +1364,7 @@ func (h *Handlers) processTargetCreate(
 
 	err = h.db.DB().Create(target).Error
 	if err != nil {
-		h.serverError(w, r, "failed to create target", err)
+		h.serverError(w, "failed to create target", err)
 
 		return
 	}
@@ -1445,7 +1458,7 @@ func (h *Handlers) buildTargetConfig(
 	case database.TargetTypeSlack:
 		return h.buildSlackTargetConfig(w, r, in.URL)
 	case database.TargetTypeDatabase:
-		return h.buildDatabaseTargetConfig(w, r, in.Expiry)
+		return h.buildDatabaseTargetConfig(w, in.Expiry)
 	case database.TargetTypeLog:
 		return "", nil
 	default:
@@ -1495,7 +1508,7 @@ func (h *Handlers) buildHTTPTargetConfig(
 		return "", err
 	}
 
-	return h.marshalTargetConfig(w, r, delivery.HTTPTargetConfig{
+	return marshalTargetConfig(w, delivery.HTTPTargetConfig{
 		URL:     in.URL,
 		Headers: headers,
 		Timeout: timeout,
@@ -1517,7 +1530,7 @@ func (h *Handlers) buildSlackTargetConfig(
 		return "", err
 	}
 
-	return h.marshalTargetConfig(w, r, delivery.SlackTargetConfig{
+	return marshalTargetConfig(w, delivery.SlackTargetConfig{
 		WebhookURL: targetURL,
 	})
 }
@@ -1571,14 +1584,16 @@ func (h *Handlers) validateTargetURL(
 
 // marshalTargetConfig serialises a target configuration for storage,
 // writing a 500 itself if it cannot.
-func (h *Handlers) marshalTargetConfig(
+func marshalTargetConfig(
 	w http.ResponseWriter,
-	r *http.Request,
 	cfg any,
 ) (string, error) {
 	configBytes, err := json.Marshal(cfg)
 	if err != nil {
-		h.serverError(w, r, "failed to encode target config", err)
+		http.Error(
+			w, "Internal server error",
+			http.StatusInternalServerError,
+		)
 
 		return "", err
 	}
@@ -1594,7 +1609,6 @@ func (h *Handlers) marshalTargetConfig(
 // expiry yields an empty config (the keep-forever default).
 func (h *Handlers) buildDatabaseTargetConfig(
 	w http.ResponseWriter,
-	r *http.Request,
 	expiry string,
 ) (string, error) {
 	expiry = strings.TrimSpace(expiry)
@@ -1613,8 +1627,8 @@ func (h *Handlers) buildDatabaseTargetConfig(
 		return "", err
 	}
 
-	return h.marshalTargetConfig(
-		w, r, map[string]any{"expiry": expiry},
+	return marshalTargetConfig(
+		w, map[string]any{"expiry": expiry},
 	)
 }
 
@@ -1668,7 +1682,7 @@ func (h *Handlers) deleteChildResource(
 			"id = ? AND user_id = ?", sourceID, userID,
 		).First(&webhook).Error
 		if err != nil {
-			h.renderError(w, r, http.StatusNotFound)
+			http.NotFound(w, r)
 
 			return
 		}
@@ -1678,7 +1692,11 @@ func (h *Handlers) deleteChildResource(
 			childID, webhook.ID,
 		).Delete(model)
 		if result.Error != nil {
-			h.serverError(w, r, errMsg, result.Error)
+			h.log.Error(errMsg, "error", result.Error)
+			http.Error(
+				w, "Internal server error",
+				http.StatusInternalServerError,
+			)
 
 			return
 		}
@@ -1768,14 +1786,18 @@ func (h *Handlers) toggleChildResource(
 			"id = ? AND user_id = ?", sourceID, userID,
 		).First(&webhook).Error
 		if err != nil {
-			h.renderError(w, r, http.StatusNotFound)
+			http.NotFound(w, r)
 
 			return
 		}
 
 		err = toggleFn(webhook.ID, childID)
 		if err != nil {
-			h.serverError(w, r, errMsg, err)
+			h.log.Error(errMsg, "error", err)
+			http.Error(
+				w, "Internal server error",
+				http.StatusInternalServerError,
+			)
 
 			return
 		}

internal/handlers/target_edit.go

@@ -88,7 +88,9 @@ func (h *Handlers) HandleTargetEditSubmit() http.HandlerFunc {
 		// middleware, which runs before CSRF parses the form.
 		err := r.ParseForm()
 		if err != nil {
-			h.renderError(w, r, http.StatusBadRequest)
+			http.Error(
+				w, "Bad request", http.StatusBadRequest,
+			)
 
 			return
 		}
@@ -155,7 +157,7 @@ func (h *Handlers) applyTargetEdit(
 
 	err = h.db.DB().Save(target).Error
 	if err != nil {
-		h.serverError(w, r, "failed to update target", err)
+		h.serverError(w, "failed to update target", err)
 
 		return
 	}
@@ -218,7 +220,7 @@ func (h *Handlers) ownedTarget(
 		chi.URLParam(r, "targetID"), webhook.ID,
 	).First(&target).Error
 	if err != nil {
-		h.renderError(w, r, http.StatusNotFound)
+		http.NotFound(w, r)
 
 		return database.Webhook{}, nil, false
 	}

internal/handlers/webhook.go

@@ -88,14 +88,14 @@ func (h *Handlers) processWebhookRequest(
 
 	headersJSON, err := json.Marshal(r.Header)
 	if err != nil {
-		h.receiverError(w, "failed to serialize headers", err)
+		h.serverError(w, "failed to serialize headers", err)
 
 		return
 	}
 
 	targets, err := h.loadActiveTargets(entrypoint.WebhookID)
 	if err != nil {
-		h.receiverError(w, "failed to query targets", err)
+		h.serverError(w, "failed to query targets", err)
 
 		return
 	}
@@ -196,7 +196,7 @@ func (h *Handlers) createAndDeliverEvent(
 		targets,
 	)
 	if err != nil {
-		h.receiverError(w, "failed to store webhook event", err)
+		h.serverError(w, "failed to store webhook event", err)
 
 		return
 	}
@@ -204,19 +204,6 @@ func (h *Handlers) createAndDeliverEvent(
 	h.finishWebhookResponse(w, event, entrypoint, tasks)
 }
 
-// receiverError logs an error and answers the sender with a plain-text
-// 500. The receiver's answers are for programs, so it never sends the
-// error page the web UI uses.
-func (h *Handlers) receiverError(
-	w http.ResponseWriter, msg string, err error,
-) {
-	h.log.Error(msg, "error", err)
-	http.Error(
-		w, "Internal server error",
-		http.StatusInternalServerError,
-	)
-}
-
 // eventSource carries the fields a new event is built from. The
 // receiver fills it from the live request; the resubmit handler fills
 // it from a stored event. Both then go through createAndFanOut, so an

internal/middleware/csrf.go

@@ -19,7 +19,7 @@ func CSRFToken(r *http.Request) string {
 // key to sign a CSRF cookie and validates a masked token submitted via
 // the "csrf_token" form field (or the "X-CSRF-Token" header) on
 // POST/PUT/PATCH/DELETE requests. Requests with an invalid or missing
-// token are logged and answered by forbidden, which must write the 403.
+// token receive a 403 Forbidden response.
 //
 // The middleware detects the client-facing transport protocol
 // per-request via reqtls.IsTLS, the single TLS predicate the session
@@ -36,9 +36,7 @@ func CSRFToken(r *http.Request) string {
 // Two gorilla/csrf instances are maintained — one with Secure cookies
 // (for TLS) and one without (for plaintext HTTP) — because the
 // csrf.Secure option is set at creation time, not per-request.
-func (m *Middleware) CSRF(
-	forbidden http.Handler,
-) func(http.Handler) http.Handler {
+func (m *Middleware) CSRF() func(http.Handler) http.Handler {
 	csrfErrorHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		// CSRF is registered ahead of RequireAuth on every route
 		// group that uses it, so this WARN is reachable by an
@@ -59,7 +57,7 @@ func (m *Middleware) CSRF(
 			"remote_addr", r.RemoteAddr,
 			"reason", csrf.FailureReason(r),
 		)
-		forbidden.ServeHTTP(w, r)
+		http.Error(w, "Forbidden - invalid CSRF token", http.StatusForbidden)
 	})
 
 	key := m.session.GetKey()

internal/middleware/csrf_test.go

@@ -18,12 +18,6 @@ import (
 // csrfCookieName is the gorilla/csrf cookie name.
 const csrfCookieName = "_gorilla_csrf"
 
-// forbidden stands in for the error page the server hands CSRF to
-// answer a refused request with.
-func forbidden(w http.ResponseWriter, _ *http.Request) {
-	w.WriteHeader(http.StatusForbidden)
-}
-
 // csrfGetToken performs a GET request through the CSRF middleware
 // and returns the token and cookies.
 func csrfGetToken(
@@ -104,7 +98,7 @@ func TestCSRF_GETSetsToken(t *testing.T) {
 
 	var gotToken string
 
-	handler := m.CSRF(http.HandlerFunc(forbidden))(http.HandlerFunc(
+	handler := m.CSRF()(http.HandlerFunc(
 		func(_ http.ResponseWriter, r *http.Request) {
 			gotToken = middleware.CSRFToken(r)
 		},
@@ -126,7 +120,7 @@ func TestCSRF_POSTWithValidToken(t *testing.T) {
 	t.Parallel()
 
 	m, _ := testMiddleware(t, config.EnvironmentDev)
-	csrfMW := m.CSRF(http.HandlerFunc(forbidden))
+	csrfMW := m.CSRF()
 
 	getReq := httptest.NewRequestWithContext(
 		context.Background(),
@@ -158,7 +152,7 @@ func csrfPOSTWithoutTokenTest(
 	t.Helper()
 
 	m, _ := testMiddleware(t, env)
-	csrfMW := m.CSRF(http.HandlerFunc(forbidden))
+	csrfMW := m.CSRF()
 
 	// GET to establish the CSRF cookie
 	getHandler := csrfMW(http.HandlerFunc(
@@ -215,7 +209,7 @@ func TestCSRF_POSTWithInvalidToken(t *testing.T) {
 	t.Parallel()
 
 	m, _ := testMiddleware(t, config.EnvironmentDev)
-	csrfMW := m.CSRF(http.HandlerFunc(forbidden))
+	csrfMW := m.CSRF()
 
 	// GET to establish the CSRF cookie
 	getHandler := csrfMW(http.HandlerFunc(
@@ -271,7 +265,7 @@ func TestCSRF_GETDoesNotValidate(t *testing.T) {
 
 	var called bool
 
-	handler := m.CSRF(http.HandlerFunc(forbidden))(http.HandlerFunc(
+	handler := m.CSRF()(http.HandlerFunc(
 		func(_ http.ResponseWriter, _ *http.Request) {
 			called = true
 		},
@@ -334,7 +328,7 @@ func csrfTookStrictPath(
 	t.Helper()
 
 	m, _ := testMiddleware(t, env)
-	csrfMW := m.CSRF(http.HandlerFunc(forbidden))
+	csrfMW := m.CSRF()
 
 	newReq := func(method string) *http.Request {
 		r := httptest.NewRequestWithContext(
@@ -483,7 +477,7 @@ func TestCSRF_ProdMode_PlaintextHTTP_POSTWithValidToken(
 	t.Parallel()
 
 	m, _ := testMiddleware(t, config.EnvironmentProd)
-	csrfMW := m.CSRF(http.HandlerFunc(forbidden))
+	csrfMW := m.CSRF()
 
 	getReq := httptest.NewRequestWithContext(
 		context.Background(),
@@ -523,7 +517,7 @@ func TestCSRF_ProdMode_BehindProxy_POSTWithValidToken(
 	t.Parallel()
 
 	m, _ := testMiddleware(t, config.EnvironmentProd)
-	csrfMW := m.CSRF(http.HandlerFunc(forbidden))
+	csrfMW := m.CSRF()
 
 	getReq := httptest.NewRequestWithContext(
 		context.Background(),
@@ -568,7 +562,7 @@ func TestCSRF_ProdMode_DirectTLS_POSTWithValidToken(
 	t.Parallel()
 
 	m, _ := testMiddleware(t, config.EnvironmentProd)
-	csrfMW := m.CSRF(http.HandlerFunc(forbidden))
+	csrfMW := m.CSRF()
 
 	getReq := httptest.NewRequestWithContext(
 		context.Background(),

internal/middleware/logbound_test.go

@@ -260,9 +260,7 @@ func logSites() map[string]logSite {
 			) http.Handler {
 				t.Helper()
 
-				return m.CSRF(http.HandlerFunc(forbidden))(
-					unreachable(t),
-				)
+				return m.CSRF()(unreachable(t))
 			},
 			send:       postNoToken,
 			wantStatus: http.StatusForbidden,

internal/middleware/middleware.go

@@ -6,6 +6,7 @@ import (
 	"log/slog"
 	"net"
 	"net/http"
+	"net/url"
 	"sync"
 	"time"
 
@@ -366,6 +367,24 @@ func (s *Middleware) CORS() func(http.Handler) http.Handler {
 	}
 }
 
+// NextParam is the query parameter on the login redirect, and the
+// login form field, that holds the page to return to after login.
+const NextParam = "next"
+
+// loginURL is the login page RequireAuth redirects to. A GET carries
+// its own path and query in NextParam so that logging in returns to
+// it; HandleLoginSubmit decides whether that value is safe to follow.
+// Other methods carry nothing, since a redirect cannot repeat them.
+func loginURL(r *http.Request) string {
+	if r.Method != http.MethodGet {
+		return "/pages/login"
+	}
+
+	return "/pages/login?" + url.Values{
+		NextParam: {r.URL.RequestURI()},
+	}.Encode()
+}
+
 // RequireAuth returns middleware that checks for a valid session.
 // Unauthenticated users are redirected to the login page.
 func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
@@ -381,7 +400,7 @@ func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
 					"error", err,
 				)
 				http.Redirect(
-					w, r, "/pages/login", http.StatusSeeOther,
+					w, r, loginURL(r), http.StatusSeeOther,
 				)
 
 				return
@@ -409,7 +428,7 @@ func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
 					),
 				)
 				http.Redirect(
-					w, r, "/pages/login", http.StatusSeeOther,
+					w, r, loginURL(r), http.StatusSeeOther,
 				)
 
 				return

internal/middleware/middleware_test.go

@@ -338,6 +338,42 @@ func TestRequireAuth_NoSession_RedirectsToLogin(t *testing.T) {
 			"unauthenticated request",
 	)
 	assert.Equal(t, http.StatusSeeOther, w.Code)
+	assert.Equal(
+		t, "/pages/login?next=%2Fdashboard", w.Header().Get("Location"),
+	)
+}
+
+// TestRequireAuth_LoginRedirectCarriesOnlyAGet pins what the login
+// redirect carries: a GET's path and query, so logging in can return
+// there, and nothing for a POST, which a redirect cannot repeat.
+func TestRequireAuth_LoginRedirectCarriesOnlyAGet(t *testing.T) {
+	t.Parallel()
+
+	m, _ := testMiddleware(t, config.EnvironmentDev)
+
+	handler := m.RequireAuth()(http.HandlerFunc(
+		func(_ http.ResponseWriter, _ *http.Request) {},
+	))
+
+	get := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "/source/abc/logs?page=2", nil,
+	)
+	w := httptest.NewRecorder()
+	handler.ServeHTTP(w, get)
+
+	assert.Equal(
+		t, "/pages/login?next=%2Fsource%2Fabc%2Flogs%3Fpage%3D2",
+		w.Header().Get("Location"),
+	)
+
+	post := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost, "/source/abc/delete", nil,
+	)
+	w = httptest.NewRecorder()
+	handler.ServeHTTP(w, post)
+
 	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
 }
 
@@ -443,7 +479,9 @@ func TestRequireAuth_UnauthenticatedSession_RedirectsToLogin(
 			"unauthenticated session",
 	)
 	assert.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
+	assert.Equal(
+		t, "/pages/login?next=%2Fdashboard", w.Header().Get("Location"),
+	)
 }
 
 // --- RequireAuth Session Expiry Tests ---
@@ -541,7 +579,9 @@ func TestRequireAuth_IdleExpiredSession_RedirectsToLogin(
 		"handler should not run for an idle-expired session",
 	)
 	assert.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
+	assert.Equal(
+		t, "/pages/login?next=%2Fdashboard", w.Header().Get("Location"),
+	)
 	assert.Empty(
 		t, sessionCookies(w),
 		"an expired session must not be refreshed",

internal/server/error_page_test.go

@@ -1,155 +0,0 @@
-package server_test
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"strconv"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/webhooker/internal/config"
-)
-
-// The link back the error page offers: to the webhook list for a
-// signed-in user, to sign-in for anyone else.
-const (
-	backToWebhooks = `<a href="/sources" class="btn-secondary">` +
-		`Back to webhooks</a>`
-	backToSignIn = `<a href="/pages/login" class="btn-primary">` +
-		`Sign in</a>`
-)
-
-// assertErrorPage checks that w is the error page for status, in the
-// normal layout, offering link.
-func assertErrorPage(
-	t *testing.T,
-	w *httptest.ResponseRecorder,
-	status int,
-	link string,
-) {
-	t.Helper()
-
-	body := w.Body.String()
-
-	assert.Equal(t, status, w.Code)
-	assert.Equal(
-		t, "text/html; charset=utf-8", w.Header().Get("Content-Type"),
-	)
-	assert.Contains(t, body, `<nav class="app-bar"`)
-	assert.Contains(
-		t, body, strconv.Itoa(status)+" "+http.StatusText(status),
-	)
-	assert.Contains(t, body, link)
-}
-
-func TestErrorPage_DeletedWebhook(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	userID, _ := env.seedUser(t, "owner", "somepassword")
-	cookies := env.authCookies(t, userID, "owner")
-
-	wh := env.seedWebhook(t, userID)
-	require.NoError(t, env.db.DB().Delete(wh).Error)
-
-	w := env.get("/source/"+wh.ID, cookies)
-
-	assertErrorPage(t, w, http.StatusNotFound, backToWebhooks)
-}
-
-func TestErrorPage_DeletedTarget(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	userID, _ := env.seedUser(t, "owner", "somepassword")
-	cookies := env.authCookies(t, userID, "owner")
-
-	wh := env.seedWebhook(t, userID)
-	tgt := env.seedTarget(t, wh.ID)
-	require.NoError(t, env.db.DB().Delete(tgt).Error)
-
-	w := env.get(
-		"/source/"+wh.ID+"/targets/"+tgt.ID+"/edit", cookies,
-	)
-
-	assertErrorPage(t, w, http.StatusNotFound, backToWebhooks)
-}
-
-func TestErrorPage_UnknownPath(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	userID, _ := env.seedUser(t, "owner", "somepassword")
-	cookies := env.authCookies(t, userID, "owner")
-
-	assertErrorPage(
-		t, env.get("/no-such-page", nil),
-		http.StatusNotFound, backToSignIn,
-	)
-
-	// Outside every route group there is no form token, so the
-	// page leaves out the logout form rather than offer one that
-	// would be refused.
-	w := env.get("/no-such-page", cookies)
-	assertErrorPage(t, w, http.StatusNotFound, backToWebhooks)
-	assert.NotContains(t, w.Body.String(), `action="/pages/logout"`)
-
-	// Inside a route group the page has a token, and logout works.
-	wh := env.seedWebhook(t, userID)
-	w = env.get("/source/"+wh.ID+"/no-such-page", cookies)
-	assertErrorPage(t, w, http.StatusNotFound, backToWebhooks)
-	assert.Contains(t, w.Body.String(), `action="/pages/logout"`)
-}
-
-func TestErrorPage_BadCSRFToken(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	form := url.Values{}
-	form.Set("username", "someone")
-	form.Set("password", "irrelevant")
-	form.Set("csrf_token", "not-a-token")
-
-	assertErrorPage(
-		t, env.post("/pages/login", form, nil),
-		http.StatusForbidden, backToSignIn,
-	)
-
-	userID, _ := env.seedUser(t, "owner", "somepassword")
-	cookies := env.authCookies(t, userID, "owner")
-	wh := env.seedWebhook(t, userID)
-
-	edit := url.Values{}
-	edit.Set("name", "renamed")
-
-	assertErrorPage(
-		t, env.post("/source/"+wh.ID+"/edit", edit, cookies),
-		http.StatusForbidden, backToWebhooks,
-	)
-}
-
-// TestErrorPage_ReceiverStaysPlain pins that the error page is for
-// the web UI only: a sender posting to an entrypoint that does not
-// exist still gets the plain-text answer.
-func TestErrorPage_ReceiverStaysPlain(t *testing.T) {
-	t.Parallel()
-
-	// newTestEnv leaves the receiver rate limit at zero, which
-	// refuses every request before it reaches the receiver.
-	env := newTestEnvWithConfig(t, &config.Config{
-		DataDir:           t.TempDir(),
-		Environment:       config.EnvironmentDev,
-		ReceiverRateLimit: 10,
-	})
-
-	w := env.post("/webhook/no-such-entrypoint", url.Values{}, nil)
-
-	assert.Equal(t, http.StatusNotFound, w.Code)
-	assert.Equal(t, "404 page not found\n", w.Body.String())
-}

internal/server/routes.go

@@ -46,14 +46,6 @@ const requestTimeout = 60 * time.Second
 // server's router.
 func (s *Server) SetupRoutes() {
 	s.router = chi.NewRouter()
-
-	// An unknown path gets the error page. Registered before the
-	// global middleware, because chi wraps a not-found handler in the
-	// middleware already on its router, which would then run twice.
-	// The route groups below wrap it in their own middleware the same
-	// way; running theirs twice is harmless.
-	s.router.NotFound(s.h.HandleErrorPage(http.StatusNotFound))
-
 	s.setupGlobalMiddleware()
 	s.setupRoutes()
 }
@@ -158,7 +150,7 @@ func (s *Server) setupPageRoutes() {
 		// MaxBodySize precedes CSRF and RequireAuth deliberately;
 		// see maxFormBodySize for why, and for what it costs.
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
-		r.Use(s.mw.CSRF(s.h.HandleErrorPage(http.StatusForbidden)))
+		r.Use(s.mw.CSRF())
 		r.Use(s.mw.NoCache())
 
 		// The login POST carries no pre-emptive rate limiter. Behind
@@ -179,7 +171,7 @@ func (s *Server) setupUserRoutes() {
 		// MaxBodySize precedes CSRF and RequireAuth deliberately;
 		// see maxFormBodySize for why, and for what it costs.
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
-		r.Use(s.mw.CSRF(s.h.HandleErrorPage(http.StatusForbidden)))
+		r.Use(s.mw.CSRF())
 		r.Use(s.mw.NoCache())
 		r.Use(s.mw.RequireAuth())
 		r.Get("/", s.h.HandleProfile())
@@ -194,7 +186,7 @@ func (s *Server) setupSourceRoutes() {
 		// MaxBodySize precedes CSRF and RequireAuth deliberately;
 		// see maxFormBodySize for why, and for what it costs.
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
-		r.Use(s.mw.CSRF(s.h.HandleErrorPage(http.StatusForbidden)))
+		r.Use(s.mw.CSRF())
 		r.Use(s.mw.NoCache())
 		r.Use(s.mw.RequireAuth())
 		r.Get("/", s.h.HandleSourceList())
@@ -206,7 +198,7 @@ func (s *Server) setupSourceRoutes() {
 		// MaxBodySize precedes CSRF and RequireAuth deliberately;
 		// see maxFormBodySize for why, and for what it costs.
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
-		r.Use(s.mw.CSRF(s.h.HandleErrorPage(http.StatusForbidden)))
+		r.Use(s.mw.CSRF())
 		r.Use(s.mw.NoCache())
 		r.Use(s.mw.RequireAuth())
 		r.Get("/", s.h.HandleSourceDetail())

internal/server/routes_test.go

@@ -680,6 +680,44 @@ func TestPagesLogin_CookiesFromAnEarlierDatabase(t *testing.T) {
 	)
 }
 
+// TestPagesLogin_ReturnsToTheRequestedPage is
+// https://git.eeqj.de/sneak/webhooker/issues/384: a page opened while
+// logged out leads to the login page, and logging in from there lands
+// on that page, query included.
+func TestPagesLogin_ReturnsToTheRequestedPage(t *testing.T) {
+	t.Parallel()
+
+	const (
+		username = "operator"
+		password = "correct-horse-battery-staple"
+	)
+
+	env := newTestEnv(t)
+	userID, _ := env.seedUser(t, username, password)
+	asked := "/source/" + env.seedWebhook(t, userID).ID + "/logs?page=2"
+
+	bounced := env.get(asked, nil)
+	require.Equal(t, http.StatusSeeOther, bounced.Code)
+
+	loginPage := bounced.Header().Get("Location")
+
+	match := regexp.MustCompile(`name="next" value="([^"]*)"`).
+		FindStringSubmatch(env.get(loginPage, nil).Body.String())
+	require.Len(t, match, 2, "the login form must carry the page")
+
+	token, cookies := env.csrfFrom(t, loginPage, nil)
+
+	form := url.Values{}
+	form.Set("csrf_token", token)
+	form.Set("username", username)
+	form.Set("password", password)
+	form.Set("next", html.UnescapeString(match[1]))
+
+	w := env.post("/pages/login", form, cookies)
+	require.Equal(t, http.StatusSeeOther, w.Code)
+	assert.Equal(t, asked, w.Header().Get("Location"))
+}
+
 // --- /user/{username} group ---
 
 // TestPasswordChange_OversizeBody_RejectedAndPasswordUnchanged
@@ -830,7 +868,10 @@ func TestSourceLogsBody_OtherUser404s(t *testing.T) {
 
 	anon := env.get(path, nil)
 	assert.Equal(t, http.StatusSeeOther, anon.Code)
-	assert.Equal(t, "/pages/login", anon.Header().Get("Location"))
+	assert.Equal(
+		t, "/pages/login?next="+url.QueryEscape(path),
+		anon.Header().Get("Location"),
+	)
 }
 
 // TestDeliveryReplay_PostOnlyAndCSRFProtected walks the replay action

templates/error.html

@@ -1,15 +0,0 @@
-{{template "base" .}}
-
-{{define "title"}}{{.StatusText}} - Webhooker{{end}}
-
-{{define "content"}}
-<div class="max-w-4xl mx-auto px-6 py-12">
-    <h1 class="text-2xl font-medium text-gray-900 mb-4">{{.Status}} {{.StatusText}}</h1>
-    <p class="text-gray-600 mb-6">{{.Message}}</p>
-    {{if .User}}
-    <a href="/sources" class="btn-secondary">Back to webhooks</a>
-    {{else}}
-    <a href="/pages/login" class="btn-primary">Sign in</a>
-    {{end}}
-</div>
-{{end}}

templates/login.html

@@ -24,6 +24,7 @@
 
             <form method="POST" action="/pages/login" class="space-y-6">
                 <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
+                <input type="hidden" name="next" value="{{.Next}}">
                 <div class="form-group">
                     <label for="username" class="label">Username</label>
                     <input

templates/navbar.html

@@ -6,12 +6,14 @@
         </div>
 
         <!-- Mobile menu button -->
+        {{if .User}}
         <button @click="open = !open" class="md:hidden p-2 rounded-md text-gray-500 hover:bg-gray-100">
             <svg class="w-6 h-6" fill="none" stroke="currentColor" viewBox="0 0 24 24">
                 <path x-show="!open" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 6h16M4 12h16M4 18h16"/>
                 <path x-show="open" x-cloak stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"/>
             </svg>
         </button>
+        {{end}}
 
         <!-- Desktop navigation -->
         <div class="hidden md:flex items-center gap-4">
@@ -24,17 +26,11 @@
                 </svg>
                 {{.User.Username}}
             </a>
-            {{/* The page for an unknown path is served outside the routes
-                 that issue a form token, and a logout without one is refused. */}}
-            {{if .CSRFToken}}
             <form method="POST" action="/pages/logout" class="inline">
                 <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
                 <button type="submit" class="btn-text">Logout</button>
             </form>
             {{end}}
-            {{else}}
-            <a href="/pages/login" class="btn-primary">Login</a>
-            {{end}}
         </div>
     </div>
 
@@ -44,15 +40,11 @@
             {{if .User}}
             <a href="/sources" class="btn-text w-full text-left">Webhooks</a>
             <a href="/user/{{.User.Username}}" class="btn-text w-full text-left">Profile</a>
-            {{if .CSRFToken}}
             <form method="POST" action="/pages/logout">
                 <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
                 <button type="submit" class="btn-text w-full text-left">Logout</button>
             </form>
             {{end}}
-            {{else}}
-            <a href="/pages/login" class="btn-primary w-full">Login</a>
-            {{end}}
         </div>
     </div>
 </nav>

templates/profile.html

@@ -41,10 +41,6 @@
                     <dt class="w-32 text-sm font-medium text-gray-500">Username</dt>
                     <dd class="text-sm text-gray-900">{{.User.Username}}</dd>
                 </div>
-                <div class="flex">
-                    <dt class="w-32 text-sm font-medium text-gray-500">Account Type</dt>
-                    <dd class="text-sm text-gray-900">Standard User</dd>
-                </div>
             </dl>
         </div>
     </div>