Redirect embedded apps to the provided return_to if it's a fully-formed URL

CHANGELOG.md

@@ -1,6 +1,7 @@
 Unreleased
 ----------
 * Fixes bug with `WebhooksManager#recreate_webhooks!` where we failed to register topics in the registry[#1743](https://github.com/Shopify/shopify_app/pull/1704)
+* Allow embedded apps to provide a full URL to get redirected to, rather than defaulting to Shopify Admin [#1746](https://github.com/Shopify/shopify_app/pull/1746)
 
 21.7.0 (Oct 12, 2023)
 ----------

app/controllers/shopify_app/callback_controller.rb

@@ -70,14 +70,25 @@ def update_rails_cookie(api_session, cookie)
 
     def redirect_to_app
       if ShopifyAPI::Context.embedded?
-        return_to = "#{decoded_host}#{session.delete(:return_to)}"
-        return_to = ShopifyApp.configuration.root_url if deduced_phishing_attack?
-        redirect_to(return_to, allow_other_host: true)
+        return_to = session.delete(:return_to)
+        redirect_to = if fully_formed_url?(return_to)
+          return_to
+        else
+          "#{decoded_host}#{return_to}"
+        end
+
+        redirect_to = ShopifyApp.configuration.root_url if deduced_phishing_attack?
+        redirect_to(redirect_to, allow_other_host: true)
       else
         redirect_to(return_address)
       end
     end
 
+    def fully_formed_url?(return_to)
+      uri = Addressable::URI.parse(return_to)
+      uri.present? && uri.scheme.present? && uri.host.present?
+    end
+
     def decoded_host
       @decoded_host ||= ShopifyAPI::Auth.embedded_app_url(params[:host])
     end

test/controllers/callback_controller_test.rb

@@ -263,14 +263,32 @@ class CallbackControllerTest < ActionController::TestCase
       assert_redirected_to non_embedded_host
     end
 
-    test "#callback redirects to the embedded app url for embedded" do
+    test "callback redirects to the return_to for embedded app when return_to is a fully-formed URL" do
+      mock_oauth
+      session[:return_to] = "https://example.com/return_to?foo=bar"
+
+      get :callback, params: @callback_params # host is required for App Bridge 2.0
+
+      assert_redirected_to "https://example.com/return_to?foo=bar"
+    end
+
+    test "#callback redirects to the embedded app url when app is embedded and return_to is not provided" do
       mock_oauth
 
       get :callback, params: @callback_params # host is required for App Bridge 2.0
 
       assert_redirected_to "https://#{@host}/admin/apps/key"
     end
 
+    test "#callback redirects to the embedded app url when app is embedded and return_to is a path" do
+      mock_oauth
+      session[:return_to] = "/return_to/path"
+
+      get :callback, params: @callback_params # host is required for App Bridge 2.0
+
+      assert_redirected_to "https://#{@host}/admin/apps/key/return_to/path"
+    end
+
     test "#callback performs install_webhook job after authentication" do
       mock_oauth