* fix: use relative redirects in booking confirmation routes to fix localhost redirect issue
When Cal.com runs behind a reverse proxy, request.url may return the internal
server URL (localhost:3000) instead of the external URL. This causes users to
be redirected to localhost after confirming bookings via email links.
This fix changes the redirect URLs from using url.origin (which could be
localhost) to using relative URLs via new URL(path, request.url). This ensures
the browser resolves the redirect against whatever domain the user actually
requested, fixing the issue for self-hosted deployments behind proxies.
Fixes#20358
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* test: add tests for booking confirmation redirect URL construction
Add unit tests for verify-booking-token and link API routes to ensure:
- Redirect URLs preserve the request origin (not hardcoded localhost)
- Redirect URLs use the correct booking path (/booking/{uid})
- Error messages are properly encoded in query params
- POST handler returns correct 303 status code
These tests verify the fix for #20358 where users were redirected to
localhost:3000 instead of the proper production URL after confirming
bookings via email links.
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
* fix: add second argument to GET/POST calls in test files to fix type errors
Co-Authored-By: Volnei Munhoz <volnei.munhoz@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* version and verify-booking-token
* username route
* api/me
* logo route
* render email in dev
* link route
* future
* nope and geo location
* referal link and daily
* intercom route and dynamic variables
* intercom route and dynamic variables
* scim 2.0 and helpscout route
* app credentials
* api/book events
* fix daily import path in tests
* fix buildLegacyRequest generation
* fix type errors
* migrate the /teams/ routes
* move cron jobs
* fix daily import path in tests
* fix buildLegacyRequest generation
* fix type errors
* migrate the /teams/ routes
* move cron jobs
* Revert "api/book events"
This reverts commit 607a32fb5b754cad090c2d0cbf64a68f990e220e.
* mock next server NextResponse to fix daily video
* add default responder to teams api
* fix search params
* uses nextUrl.searchParams instead of new url
* uses nextUrl.searchParams instead of new url
* remove outdated api config
* remove app dir version of inbound dynamic variables
* restore pages version of inbound variables
* fix missing code from stupid cursor
---------
Co-authored-by: Benny Joo <sldisek783@gmail.com>
