mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-16 16:45:07 +00:00
denkfabrik-li
4737849ec5
A redirect born in exception handling - the guest redirect after an expired login, above all - never travels back through the middleware stack, so Inertia's usual 302-to-303 upgrade cannot reach it. Browsers follow a 302 by replaying the request method on the redirect target (only POST is downgraded to GET), so a widget save whose session just died replays as PUT /login and fails with a 405 that hides the real "please sign in again" (#1673). Repeat the upgrade in the exception pipeline: any 302 answered to a PUT, PATCH or DELETE becomes a 303. Reads keep their 302, POST needs nothing - browsers already downgrade it.