fix(auth): state carries target URL, cross-subdomain cookie domain

src/core/auth/oidc.go

@@ -35,7 +35,14 @@ func NewOIDCHandler(config OIDCConfig, store *SessionStore) *OIDCHandler {
 
 // LoginRedirect redirects the user to Authelia's OIDC authorization endpoint.
 func (h *OIDCHandler) LoginRedirect(w http.ResponseWriter, r *http.Request) {
-	state := generateToken(16)
+	// Get target URL from current request path
+	targetURL := r.URL.Path
+	if targetURL == "/" || targetURL == "/access" {
+		targetURL = "/"
+	}
+	// Embed target in state: random_token:target_url
+	randPart := generateToken(16)
+	state := randPart + ":" + targetURL
 	nonce := generateToken(16)
 
 	// PKCE: generate code verifier and challenge
@@ -45,7 +52,7 @@ func (h *OIDCHandler) LoginRedirect(w http.ResponseWriter, r *http.Request) {
 	// Store state + verifier in cookies (shared across subdomains)
 	http.SetCookie(w, &http.Cookie{
 		Name:     "oidc_state",
-		Value:    state,
+		Value:    randPart,
 		Path:     "/",
 		MaxAge:   300,
 		HttpOnly: true,
@@ -65,7 +72,7 @@ func (h *OIDCHandler) LoginRedirect(w http.ResponseWriter, r *http.Request) {
 		h.config.IssuerURL,
 		url.QueryEscape(h.config.ClientID),
 		url.QueryEscape(h.config.RedirectURL),
-		state,
+		url.QueryEscape(state),
 		nonce,
 		challenge,
 	)
@@ -243,7 +250,6 @@ func (h *OIDCHandler) LoginRedirectWithPrompt(w http.ResponseWriter, r *http.Req
 	verifier := generateToken(32)
 	challenge := pkceChallenge(verifier)
 
-
 	authURL := fmt.Sprintf(
 		"%s/api/oidc/authorize?prompt=%s&response_type=code&client_id=%s&redirect_uri=%s&scope=openid+profile+email&state=%s&nonce=%s&code_challenge=%s&code_challenge_method=S256",
 		h.config.IssuerURL, prompt,