Arvados

The return_to param passed to controller's /login endpoint can have any path and query string. The query string should be constructed with proper escaping using encodeURIComponent (current code uses "https://controller.example/login?...&return_to=https://wb2.example/token" which is incorrect).

Controller will preserve the query string if present, and append &api_token=xxxxxx to it when sending the user back to wb2 after login.

• https://wb2.example/current_path?current&query&string ...if it's convenient for wb2 to handle the incoming token and redact it from the location bar regardless of which route/page it lands on, or
• https://wb2.example/token?redirectTo=%2Fcurrent_path%3Fcurrent%26query%26string ...if it's more convenient for wb2 to only handle an incoming token at a specific /token page and then navigate to the redirectTo address

Applied in arvados-workbench2|761e9780888a343e0655563acea23577eeb5d29a