Intent: the address people type to sign in works. Replaces #6038, which was parked twice: the first try failed because the Server-Timing sweep treats any new 3xx GET route as a page that stopped naming its phases; the second failed on an unrelated scorecard test.
Done:
[ ] router.add("GET", "/login", …) and router.add("GET", "/sign-in", …) in src/http/server.ts answer 308 to /signin, carrying next only when it is a same-origin path (one leading /, not //, not a scheme), reusing the check /signin already applies to next — no second validator
[ ] /login and /sign-in are added to the REDIRECTS set in test/server-timing-sweep.test.ts (that set exists exactly for routes that answer 3xx); nothing is added to UNNAMED
[ ] /signup is untouched; no other alias is added
[ ] test/signin-alias.test.ts: both aliases answer 308 to /signin; next=/settings survives; next=//evil.test and next=https://evil.test are dropped
[ ] bun test test/server-timing-sweep.test.ts test/signin-alias.test.ts passes locally before push
Files: src/http/server.ts, test/server-timing-sweep.test.ts, test/signin-alias.test.ts
Risk: an open redirect through next. Do not touch scorecard, proof or looks files; if an unrelated test fails in the check, say so in the pull rather than editing it.
Intent: the address people type to sign in works. Replaces #6038, which was parked twice: the first try failed because the Server-Timing sweep treats any new 3xx GET route as a page that stopped naming its phases; the second failed on an unrelated scorecard test.
Done:
router.add("GET", "/login", …)androuter.add("GET", "/sign-in", …)insrc/http/server.tsanswer 308 to/signin, carryingnextonly when it is a same-origin path (one leading/, not//, not a scheme), reusing the check/signinalready applies tonext— no second validator/loginand/sign-inare added to theREDIRECTSset intest/server-timing-sweep.test.ts(that set exists exactly for routes that answer 3xx); nothing is added toUNNAMED/signupis untouched; no other alias is addedtest/signin-alias.test.ts: both aliases answer 308 to/signin;next=/settingssurvives;next=//evil.testandnext=https://evil.testare droppedbun test test/server-timing-sweep.test.ts test/signin-alias.test.tspasses locally before pushFiles: src/http/server.ts, test/server-timing-sweep.test.ts, test/signin-alias.test.ts Risk: an open redirect through
next. Do not touch scorecard, proof or looks files; if an unrelated test fails in the check, say so in the pull rather than editing it.