Stash intended URL in session for 2FA setup middleware

The frontend RedirectIfTwoFactorSetupIncomplete middleware previously
threaded the original URL through a referer query string, but the
TwoFactorSetupController had been switched to read url.intended from
the session — leaving the query string dead and dropping the original
URL for already-authenticated users bounced into setup. Both middlewares
now stash the URL via setIntendedUrl, and the CP setup controller reads
it back via getIntendedUrl, keeping CP and frontend on the same
mechanism.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jasonvarga

src/Http/Controllers/CP/Auth/TwoFactorSetupController.php

@@ -16,10 +16,10 @@ public function __construct(Request $request)
     protected function redirectPath()
     {
         $cp = cp_route('index');
-        $referer = request('referer');
-        $referredFromCp = Str::startsWith($referer, $cp) && ! Str::startsWith($referer, $cp.'/auth/');
+        $intended = redirect()->getIntendedUrl();
+        $isCpUrl = $intended && Str::startsWith($intended, $cp) && ! Str::startsWith($intended, $cp.'/auth/');
 
-        return $referredFromCp ? $referer : $cp;
+        return $isCpUrl ? $intended : $cp;
     }
 
     protected function routes($user): array

src/Http/Middleware/CP/RedirectIfTwoFactorSetupIncomplete.php

@@ -2,7 +2,6 @@
 
 namespace Statamic\Http\Middleware\CP;
 
-use Illuminate\Http\Request;
 use Statamic\Http\Middleware\RedirectIfTwoFactorSetupIncomplete as Middleware;
 
 class RedirectIfTwoFactorSetupIncomplete extends Middleware
@@ -12,10 +11,8 @@ protected function redirectRoute(): string
         return 'statamic.cp.two-factor-setup';
     }
 
-    protected function redirectUrl(Request $request): string
+    protected function redirectUrl(): string
     {
-        return route($this->redirectRoute(), [
-            'referer' => $request->fullUrl(),
-        ]);
+        return route($this->redirectRoute());
     }
 }

src/Http/Middleware/RedirectIfTwoFactorSetupIncomplete.php

@@ -23,7 +23,9 @@ public function handle(Request $request, Closure $next)
                 app(EnableTwoFactorAuthentication::class)($user);
             }
 
-            return redirect($this->redirectUrl($request));
+            redirect()->setIntendedUrl($request->fullUrl());
+
+            return redirect($this->redirectUrl());
         }
 
         return $next($request);
@@ -41,15 +43,9 @@ protected function isSetupUrl(Request $request): bool
         return $currentPath === $customPath;
     }
 
-    protected function redirectUrl(Request $request): string
+    protected function redirectUrl(): string
     {
-        if ($url = config('statamic.users.two_factor_setup_url')) {
-            return $url;
-        }
-
-        return route($this->redirectRoute(), [
-            'referer' => $request->fullUrl(),
-        ]);
+        return config('statamic.users.two_factor_setup_url') ?? route($this->redirectRoute());
     }
 
     protected function redirectRoute(): string

tests/Feature/Users/TwoFactorRoutesTest.php

@@ -63,7 +63,8 @@ public function cp_two_factor_setup_middleware_redirects_when_two_factor_is_enfo
         $this
             ->actingAs($user)
             ->get(cp_route('dashboard'))
-            ->assertRedirect(cp_route('two-factor-setup', ['referer' => cp_route('dashboard')]));
+            ->assertRedirect(cp_route('two-factor-setup'))
+            ->assertSessionHas('url.intended', cp_route('dashboard'));
     }
 
     #[Test]
@@ -93,7 +94,8 @@ public function cp_two_factor_setup_middleware_ignores_frontend_setup_url_config
         $this
             ->actingAs($user)
             ->get(cp_route('dashboard'))
-            ->assertRedirect(cp_route('two-factor-setup', ['referer' => cp_route('dashboard')]));
+            ->assertRedirect(cp_route('two-factor-setup'))
+            ->assertSessionHas('url.intended', cp_route('dashboard'));
     }
 
     #[Test]
@@ -106,7 +108,8 @@ public function frontend_two_factor_setup_middleware_redirects_when_two_factor_i
         $this
             ->actingAs($user)
             ->get('/test-frontend-route')
-            ->assertRedirect(route('statamic.two-factor-setup', ['referer' => url('/test-frontend-route')]));
+            ->assertRedirect(route('statamic.two-factor-setup'))
+            ->assertSessionHas('url.intended', url('/test-frontend-route'));
     }
 
     #[Test]
@@ -121,7 +124,8 @@ public function frontend_two_factor_setup_middleware_generates_secret_when_none_
         $this
             ->actingAs($user)
             ->get('/test-frontend-route')
-            ->assertRedirect(route('statamic.two-factor-setup', ['referer' => url('/test-frontend-route')]));
+            ->assertRedirect(route('statamic.two-factor-setup'))
+            ->assertSessionHas('url.intended', url('/test-frontend-route'));
 
         $this->assertNotNull($user->fresh()->two_factor_secret);
     }
@@ -138,7 +142,8 @@ public function frontend_two_factor_setup_middleware_does_not_regenerate_existin
         $this
             ->actingAs($user)
             ->get('/test-frontend-route')
-            ->assertRedirect(route('statamic.two-factor-setup', ['referer' => url('/test-frontend-route')]));
+            ->assertRedirect(route('statamic.two-factor-setup'))
+            ->assertSessionHas('url.intended', url('/test-frontend-route'));
 
         $this->assertEquals($existing, $user->fresh()->two_factor_secret);
     }

tests/Feature/Users/TwoFactorSetupTest.php

@@ -35,13 +35,12 @@ public function it_redirects_to_the_dashboard_if_the_user_is_already_set_up()
     }
 
     #[Test]
-    public function redirect_url_is_referer()
+    public function redirect_url_is_intended_url()
     {
         $this
             ->actingAs($this->user())
-            ->get(cp_route('two-factor-setup', [
-                'referer' => 'http://localhost/cp/collections',
-            ]))
+            ->withSession(['url.intended' => 'http://localhost/cp/collections'])
+            ->get(cp_route('two-factor-setup'))
             ->assertInertia(fn ($page) => $page->where('redirect', 'http://localhost/cp/collections'));
     }