New: Use 307 redirect for requests missing URL Base

(cherry picked from commit 39074b0b1d040969f86d787c2346d5ed5a9f72dc)

.gitignore

@@ -120,6 +120,7 @@ _artifacts
 _rawPackage/
 _dotTrace*
 _tests/
+_temp*
 *.Result.xml
 coverage*.xml
 coverage*.json

azure-pipelines.yml

@@ -9,7 +9,7 @@ variables:
   testsFolder: './_tests'
   yarnCacheFolder: $(Pipeline.Workspace)/.yarn
   nugetCacheFolder: $(Pipeline.Workspace)/.nuget/packages
-  majorVersion: '0.4.0'
+  majorVersion: '0.4.1'
   minorVersion: $[counter('minorVersion', 1)]
   readarrVersion: '$(majorVersion).$(minorVersion)'
   buildName: '$(Build.SourceBranchName).$(readarrVersion)'
@@ -20,7 +20,7 @@ variables:
   innoVersion: '6.2.0'
   windowsImage: 'windows-2022'
   linuxImage: 'ubuntu-20.04'
-  macImage: 'macOS-12'
+  macImage: 'macOS-13'
 
 trigger:
   branches:

frontend/.vscode/settings.json

@@ -9,7 +9,7 @@
 
   "editor.formatOnSave": false,
   "editor.codeActionsOnSave": {
-    "source.fixAll": true
+    "source.fixAll": "explicit"
   },
 
   "typescript.preferences.quoteStyle": "single",

frontend/src/Components/MonitorToggleButton.css

@@ -3,9 +3,9 @@
 
   padding: 0;
   font-size: inherit;
-}
 
-.isDisabled {
+  &.isDisabled {
-  color: var(--disabledColor);
+    color: var(--disabledColor);
-  cursor: not-allowed;
+    cursor: not-allowed;
+  }
 }

frontend/src/Settings/MediaManagement/Naming/NamingConnector.js

@@ -1,4 +1,3 @@
-import _ from 'lodash';
 import PropTypes from 'prop-types';
 import React, { Component } from 'react';
 import { connect } from 'react-redux';
@@ -15,11 +14,11 @@ function createMapStateToProps() {
     (state) => state.settings.advancedSettings,
     (state) => state.settings.namingExamples,
     createSettingsSectionSelector(SECTION),
-    (advancedSettings, examples, sectionSettings) => {
+    (advancedSettings, namingExamples, sectionSettings) => {
       return {
         advancedSettings,
-        examples: examples.item,
+        examples: namingExamples.item,
-        examplesPopulated: !_.isEmpty(examples.item),
+        examplesPopulated: namingExamples.isPopulated,
         ...sectionSettings
       };
     }

src/Directory.Packages.props

@@ -4,6 +4,7 @@
     <PackageVersion Include="AutoFixture" Version="4.17.0" />
     <PackageVersion Include="coverlet.collector" Version="3.0.4-preview.27.ge7cb7c3b40" PrivateAssets="all" />
     <PackageVersion Include="Dapper" Version="2.0.151" />
+    <PackageVersion Include="Diacritical.Net" Version="1.0.4" />
     <PackageVersion Include="DryIoc.dll" Version="5.4.3" />
     <PackageVersion Include="DryIoc.Microsoft.DependencyInjection" Version="6.2.0" />
     <PackageVersion Include="Equ" Version="2.3.0" />
@@ -65,4 +66,4 @@
     <PackageVersion Include="System.ValueTuple" Version="4.5.0" />
     <PackageVersion Include="TagLibSharp-Lidarr" Version="2.2.0.19" />
   </ItemGroup>
-</Project>
+</Project>

src/NzbDrone.Common.Test/InstrumentationTests/CleanseLogMessageFixture.cs

@@ -89,6 +89,10 @@ namespace NzbDrone.Common.Test.InstrumentationTests
         [TestCase(@"https://discord.com/api/webhooks/mySecret")]
         [TestCase(@"https://discord.com/api/webhooks/mySecret/01233210")]
 
+        // Telegram
+        [TestCase(@"https://api.telegram.org/bot1234567890:mySecret/sendmessage: chat_id=123456&parse_mode=HTML&text=<text>")]
+        [TestCase(@"https://api.telegram.org/bot1234567890:mySecret/")]
+
         public void should_clean_message(string message)
         {
             var cleansedMessage = CleanseLogMessage.Cleanse(message);

src/NzbDrone.Common/Instrumentation/CleanseLogMessage.cs

@@ -54,7 +54,10 @@ namespace NzbDrone.Common.Instrumentation
             new (@"api/v[0-9]/notification/readarr/(?<secret>[\w-]+)", RegexOptions.Compiled | RegexOptions.IgnoreCase),
 
             // Discord
-            new (@"discord.com/api/webhooks/((?<secret>[\w-]+)/)?(?<secret>[\w-]+)", RegexOptions.Compiled | RegexOptions.IgnoreCase)
+            new (@"discord.com/api/webhooks/((?<secret>[\w-]+)/)?(?<secret>[\w-]+)", RegexOptions.Compiled | RegexOptions.IgnoreCase),
+
+            // Telegram
+            new (@"api.telegram.org/bot(?<id>[\d]+):(?<secret>[\w-]+)/", RegexOptions.Compiled | RegexOptions.IgnoreCase)
         };
 
         private static readonly Regex CleanseRemoteIPRegex = new (@"(?:Auth-\w+(?<!Failure|Unauthorized) ip|from) (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", RegexOptions.Compiled);

src/NzbDrone.Core.Test/Download/DownloadClientTests/TransmissionTests/TransmissionFixture.cs

@@ -49,10 +49,13 @@ namespace NzbDrone.Core.Test.Download.DownloadClientTests.TransmissionTests
         }
 
         [Test]
-        public void magnet_download_should_not_return_the_item()
+        public void magnet_download_should_be_returned_as_queued()
         {
             PrepareClientToReturnMagnetItem();
-            Subject.GetItems().Count().Should().Be(0);
+
+            var item = Subject.GetItems().Single();
+
+            item.Status.Should().Be(DownloadItemStatus.Queued);
         }
 
         [Test]

src/NzbDrone.Core.Test/Download/DownloadClientTests/VuzeTests/VuzeFixture.cs

@@ -60,7 +60,10 @@ namespace NzbDrone.Core.Test.Download.DownloadClientTests.VuzeTests
         public void magnet_download_should_not_return_the_item()
         {
             PrepareClientToReturnMagnetItem();
-            Subject.GetItems().Count().Should().Be(0);
+
+            var item = Subject.GetItems().Single();
+
+            item.Status.Should().Be(DownloadItemStatus.Queued);
         }
 
         [Test]

src/NzbDrone.Core.Test/MetadataSource/BookInfo/BookInfoProxyFixture.cs

@@ -13,7 +13,7 @@ using NzbDrone.Core.Test.Framework;
 namespace NzbDrone.Core.Test.MetadataSource.Goodreads
 {
     [TestFixture]
-    [Ignore("Waiting for metadata to be back again", Until = "2024-08-15 00:00:00Z")]
+    [Ignore("Waiting for metadata to be back again", Until = "2024-12-15 00:00:00Z")]
     public class BookInfoProxyFixture : CoreTest<BookInfoProxy>
     {
         private MetadataProfile _metadataProfile;

src/NzbDrone.Core.Test/MetadataSource/BookInfo/BookInfoProxySearchFixture.cs

@@ -15,7 +15,7 @@ using NzbDrone.Test.Common;
 namespace NzbDrone.Core.Test.MetadataSource.Goodreads
 {
     [TestFixture]
-    [Ignore("Waiting for metadata to be back again", Until = "2024-08-15 00:00:00Z")]
+    [Ignore("Waiting for metadata to be back again", Until = "2024-12-15 00:00:00Z")]
     public class BookInfoProxySearchFixture : CoreTest<BookInfoProxy>
     {
         [SetUp]

src/NzbDrone.Core/Download/Clients/Transmission/TransmissionBase.cs

@@ -41,12 +41,6 @@ namespace NzbDrone.Core.Download.Clients.Transmission
 
             foreach (var torrent in torrents)
             {
-                // If totalsize == 0 the torrent is a magnet downloading metadata
-                if (torrent.TotalSize == 0)
-                {
-                    continue;
-                }
-
                 var outputPath = new OsPath(torrent.DownloadDir);
 
                 if (Settings.TvDirectory.IsNotNullOrWhiteSpace())
@@ -97,6 +91,10 @@ namespace NzbDrone.Core.Download.Clients.Transmission
                     item.Status = DownloadItemStatus.Warning;
                     item.Message = torrent.ErrorString;
                 }
+                else if (torrent.TotalSize == 0)
+                {
+                    item.Status = DownloadItemStatus.Queued;
+                }
                 else if (torrent.LeftUntilDone == 0 && (torrent.Status == TransmissionTorrentStatus.Stopped ||
                                                         torrent.Status == TransmissionTorrentStatus.Seeding ||
                                                         torrent.Status == TransmissionTorrentStatus.SeedingWait))

src/NzbDrone.Core/Notifications/Discord/Discord.cs

@@ -25,15 +25,15 @@ namespace NzbDrone.Core.Notifications.Discord
         public override void OnGrab(GrabMessage message)
         {
             var embeds = new List<Embed>
-                              {
+            {
-                                  new Embed
+                new ()
-                                  {
+                {
-                                      Description = message.Message,
+                    Description = message.Message,
-                                      Title = message.Author.Name,
+                    Title = message.Author.Name,
-                                      Text = message.Message,
+                    Text = message.Message,
-                                      Color = (int)DiscordColors.Warning
+                    Color = (int)DiscordColors.Warning
-                                  }
+                }
-                              };
+            };
             var payload = CreatePayload($"Grabbed: {message.Message}", embeds);
 
             _proxy.SendPayload(payload, Settings);
@@ -43,7 +43,7 @@ namespace NzbDrone.Core.Notifications.Discord
         {
             var attachments = new List<Embed>
             {
-                new Embed
+                new ()
                 {
                     Description = message.Message,
                     Title = message.Author.Name,
@@ -59,12 +59,12 @@ namespace NzbDrone.Core.Notifications.Discord
         public override void OnRename(Author author, List<RenamedBookFile> renamedFiles)
         {
             var attachments = new List<Embed>
-                              {
+            {
-                                  new Embed
+                new ()
-                                  {
+                {
-                                      Title = author.Name,
+                    Title = author.Name,
-                                  }
+                }
-                              };
+            };
 
             var payload = CreatePayload("Renamed", attachments);
 
@@ -74,21 +74,21 @@ namespace NzbDrone.Core.Notifications.Discord
         public override void OnAuthorAdded(Author author)
         {
             var attachments = new List<Embed>
-                              {
+            {
-                                  new Embed
+                new ()
-                                  {
+                {
-                                      Title = author.Name,
+                    Title = author.Name,
-                                      Fields = new List<DiscordField>()
+                    Fields = new List<DiscordField>()
-                                      {
+                    {
-                                          new DiscordField()
+                        new ()
-                                          {
+                        {
-                                              Name = "Links",
+                            Name = "Links",
-                                              Value = string.Join(" / ", author.Metadata.Value.Links.Select(link => $"[{link.Name}]({link.Url})"))
+                            Value = string.Join(" / ", author.Metadata.Value.Links.Select(link => $"[{link.Name}]({link.Url})"))
-                                          }
+                        }
-                                      },
+                    },
-                                  }
+                }
-                              };
+            };
-            var payload = CreatePayload($"Author Added", attachments);
+            var payload = CreatePayload("Author Added", attachments);
 
             _proxy.SendPayload(payload, Settings);
         }
@@ -96,13 +96,13 @@ namespace NzbDrone.Core.Notifications.Discord
         public override void OnAuthorDelete(AuthorDeleteMessage deleteMessage)
         {
             var attachments = new List<Embed>
-                              {
+            {
-                                  new Embed
+                new ()
-                                  {
+                {
-                                      Title = deleteMessage.Author.Name,
+                    Title = deleteMessage.Author.Name,
-                                      Description = deleteMessage.DeletedFilesMessage
+                    Description = deleteMessage.DeletedFilesMessage
-                                  }
+                }
-                              };
+            };
 
             var payload = CreatePayload("Author Deleted", attachments);
 
@@ -112,13 +112,13 @@ namespace NzbDrone.Core.Notifications.Discord
         public override void OnBookDelete(BookDeleteMessage deleteMessage)
         {
             var attachments = new List<Embed>
-                              {
+            {
-                                  new Embed
+                new ()
-                                  {
+                {
-                                    Title = $"${deleteMessage.Book.Author.Value.Name} - ${deleteMessage.Book.Title}",
+                    Title = $"{deleteMessage.Book.Author.Value.Name} - ${deleteMessage.Book.Title}",
-                                    Description = deleteMessage.DeletedFilesMessage
+                    Description = deleteMessage.DeletedFilesMessage
-                                  }
+                }
-                              };
+            };
 
             var payload = CreatePayload("Book Deleted", attachments);
 
@@ -128,13 +128,13 @@ namespace NzbDrone.Core.Notifications.Discord
         public override void OnBookFileDelete(BookFileDeleteMessage deleteMessage)
         {
             var attachments = new List<Embed>
-                              {
+            {
-                                  new Embed
+                new ()
-                                  {
+                {
-                                    Title = $"${deleteMessage.Book.Author.Value.Name} - ${deleteMessage.Book.Title} - file deleted",
+                    Title = $"{deleteMessage.Book.Author.Value.Name} - ${deleteMessage.Book.Title} - file deleted",
-                                    Description = deleteMessage.BookFile.Path
+                    Description = deleteMessage.BookFile.Path
-                                  }
+                }
-                              };
+            };
 
             var payload = CreatePayload("Book File Deleted", attachments);
 
@@ -144,14 +144,14 @@ namespace NzbDrone.Core.Notifications.Discord
         public override void OnHealthIssue(HealthCheck.HealthCheck healthCheck)
         {
             var attachments = new List<Embed>
-                              {
+            {
-                                  new Embed
+                new ()
-                                  {
+                {
-                                      Title = healthCheck.Source.Name,
+                    Title = healthCheck.Source.Name,
-                                      Text = healthCheck.Message,
+                    Text = healthCheck.Message,
-                                      Color = healthCheck.Type == HealthCheck.HealthCheckResult.Warning ? (int)DiscordColors.Warning : (int)DiscordColors.Danger
+                    Color = healthCheck.Type == HealthCheck.HealthCheckResult.Warning ? (int)DiscordColors.Warning : (int)DiscordColors.Danger
-                                  }
+                }
-                              };
+            };
 
             var payload = CreatePayload("Health Issue", attachments);
 
@@ -161,13 +161,13 @@ namespace NzbDrone.Core.Notifications.Discord
         public override void OnBookRetag(BookRetagMessage message)
         {
             var attachments = new List<Embed>
-                              {
+            {
-                                  new Embed
+                new ()
-                                  {
+                {
-                                      Title = BOOK_RETAGGED_TITLE,
+                    Title = BOOK_RETAGGED_TITLE,
-                                      Text = message.Message
+                    Text = message.Message
-                                  }
+                }
-                              };
+            };
 
             var payload = CreatePayload($"Track file tags updated: {message.Message}", attachments);
 
@@ -178,7 +178,7 @@ namespace NzbDrone.Core.Notifications.Discord
         {
             var attachments = new List<Embed>
             {
-                new Embed
+                new ()
                 {
                     Description = message.Message,
                     Title = message.SourceTitle,
@@ -195,7 +195,7 @@ namespace NzbDrone.Core.Notifications.Discord
         {
             var attachments = new List<Embed>
             {
-                new Embed
+                new ()
                 {
                     Description = message.Message,
                     Title = message.Book?.Title ?? message.Message,
@@ -211,32 +211,32 @@ namespace NzbDrone.Core.Notifications.Discord
         public override void OnApplicationUpdate(ApplicationUpdateMessage updateMessage)
         {
             var attachments = new List<Embed>
-                              {
+            {
-                                  new Embed
+                new ()
-                                  {
+                {
-                                      Author = new DiscordAuthor
+                    Author = new DiscordAuthor
-                                      {
+                    {
-                                          Name = Settings.Author.IsNullOrWhiteSpace() ? Environment.MachineName : Settings.Author,
+                        Name = Settings.Author.IsNullOrWhiteSpace() ? Environment.MachineName : Settings.Author,
-                                          IconUrl = "https://raw.githubusercontent.com/Readarr/Readarr/develop/Logo/256.png"
+                        IconUrl = "https://raw.githubusercontent.com/Readarr/Readarr/develop/Logo/256.png"
-                                      },
+                    },
-                                      Title = APPLICATION_UPDATE_TITLE,
+                    Title = APPLICATION_UPDATE_TITLE,
-                                      Timestamp = DateTime.UtcNow.ToString("yyyy-MM-ddTHH:mm:ss.fffZ"),
+                    Timestamp = DateTime.UtcNow.ToString("yyyy-MM-ddTHH:mm:ss.fffZ"),
-                                      Color = (int)DiscordColors.Standard,
+                    Color = (int)DiscordColors.Standard,
-                                      Fields = new List<DiscordField>()
+                    Fields = new List<DiscordField>()
-                                      {
+                    {
-                                          new DiscordField()
+                        new ()
-                                          {
+                        {
-                                              Name = "Previous Version",
+                            Name = "Previous Version",
-                                              Value = updateMessage.PreviousVersion.ToString()
+                            Value = updateMessage.PreviousVersion.ToString()
-                                          },
+                        },
-                                          new DiscordField()
+                        new ()
-                                          {
+                        {
-                                              Name = "New Version",
+                            Name = "New Version",
-                                              Value = updateMessage.NewVersion.ToString()
+                            Value = updateMessage.NewVersion.ToString()
-                                          }
+                        }
-                                      },
+                    },
-                                  }
+                }
-                              };
+            };
 
             var payload = CreatePayload(null, attachments);
 

src/NzbDrone.Core/Readarr.Core.csproj

@@ -4,6 +4,7 @@
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="Dapper" />
+    <PackageReference Include="Diacritical.Net" />
     <PackageReference Include="LazyCache" />
     <PackageReference Include="Polly" />
     <PackageReference Include="System.Text.Json" />

src/NzbDrone.Host/Startup.cs

@@ -135,7 +135,7 @@ namespace NzbDrone.Host
                     Name = "apikey",
                     Type = SecuritySchemeType.ApiKey,
                     Scheme = "apiKey",
-                    Description = "Apikey passed as header",
+                    Description = "Apikey passed as query parameter",
                     In = ParameterLocation.Query,
                     Reference = new OpenApiReference
                     {

src/NzbDrone.Integration.Test/ApiTests/AuthorEditorFixture.cs

@@ -7,7 +7,7 @@ using Readarr.Api.V1.Author;
 namespace NzbDrone.Integration.Test.ApiTests
 {
     [TestFixture]
-    [Ignore("Waiting for metadata to be back again", Until = "2024-08-15 00:00:00Z")]
+    [Ignore("Waiting for metadata to be back again", Until = "2024-12-15 00:00:00Z")]
     public class AuthorEditorFixture : IntegrationTest
     {
         private void GivenExistingAuthor()

src/NzbDrone.Integration.Test/ApiTests/AuthorFixture.cs

@@ -7,7 +7,7 @@ using NUnit.Framework;
 namespace NzbDrone.Integration.Test.ApiTests
 {
     [TestFixture]
-    [Ignore("Waiting for metadata to be back again", Until = "2024-08-15 00:00:00Z")]
+    [Ignore("Waiting for metadata to be back again", Until = "2024-12-15 00:00:00Z")]
     public class AuthorFixture : IntegrationTest
     {
         [Test]

src/NzbDrone.Integration.Test/ApiTests/AuthorLookupFixture.cs

@@ -4,7 +4,7 @@ using NUnit.Framework;
 namespace NzbDrone.Integration.Test.ApiTests
 {
     [TestFixture]
-    [Ignore("Waiting for metadata to be back again", Until = "2024-08-15 00:00:00Z")]
+    [Ignore("Waiting for metadata to be back again", Until = "2024-12-15 00:00:00Z")]
     public class AuthorLookupFixture : IntegrationTest
     {
         [TestCase("Robert Harris", "Robert Harris")]

src/NzbDrone.Integration.Test/ApiTests/BlocklistFixture.cs

@@ -6,7 +6,7 @@ using Readarr.Api.V1.Blocklist;
 namespace NzbDrone.Integration.Test.ApiTests
 {
     [TestFixture]
-    [Ignore("Waiting for metadata to be back again", Until = "2024-08-15 00:00:00Z")]
+    [Ignore("Waiting for metadata to be back again", Until = "2024-12-15 00:00:00Z")]
     public class BlocklistFixture : IntegrationTest
     {
         private AuthorResource _author;

src/NzbDrone.Integration.Test/ApiTests/CalendarFixture.cs

@@ -9,7 +9,7 @@ using Readarr.Api.V1.Books;
 namespace NzbDrone.Integration.Test.ApiTests
 {
     [TestFixture]
-    [Ignore("Waiting for metadata to be back again", Until = "2024-08-15 00:00:00Z")]
+    [Ignore("Waiting for metadata to be back again", Until = "2024-12-15 00:00:00Z")]
     public class CalendarFixture : IntegrationTest
     {
         public ClientBase<BookResource> Calendar;

src/NzbDrone.Integration.Test/ApiTests/WantedTests/CutoffUnmetFixture.cs

@@ -8,7 +8,7 @@ using Readarr.Api.V1.RootFolders;
 namespace NzbDrone.Integration.Test.ApiTests.WantedTests
 {
     [TestFixture]
-    [Ignore("Waiting for metadata to be back again", Until = "2024-08-15 00:00:00Z")]
+    [Ignore("Waiting for metadata to be back again", Until = "2024-12-15 00:00:00Z")]
     public class CutoffUnmetFixture : IntegrationTest
     {
         [SetUp]

src/NzbDrone.Integration.Test/ApiTests/WantedTests/MissingFixture.cs

@@ -7,7 +7,7 @@ using Readarr.Api.V1.RootFolders;
 namespace NzbDrone.Integration.Test.ApiTests.WantedTests
 {
     [TestFixture]
-    [Ignore("Waiting for metadata to be back again", Until = "2024-08-15 00:00:00Z")]
+    [Ignore("Waiting for metadata to be back again", Until = "2024-12-15 00:00:00Z")]
     public class MissingFixture : IntegrationTest
     {
         [SetUp]

src/Readarr.Api.V1/openapi.json

@@ -13815,7 +13815,7 @@
       },
       "apikey": {
         "type": "apiKey",
-        "description": "Apikey passed as header",
+        "description": "Apikey passed as query parameter",
         "name": "apikey",
         "in": "query"
       }

src/Readarr.Http/Authentication/AuthenticationBuilderExtensions.cs

@@ -1,12 +1,18 @@
 using System;
+using System.Text.RegularExpressions;
+using Diacritical;
 using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.Extensions.DependencyInjection;
 using NzbDrone.Core.Authentication;
+using NzbDrone.Core.Configuration;
 
 namespace Readarr.Http.Authentication
 {
     public static class AuthenticationBuilderExtensions
     {
+        private static readonly Regex CookieNameRegex = new Regex(@"[^a-z0-9]+", RegexOptions.Compiled | RegexOptions.IgnoreCase);
+
         public static AuthenticationBuilder AddApiKey(this AuthenticationBuilder authenticationBuilder, string name, Action<ApiKeyAuthenticationOptions> options)
         {
             return authenticationBuilder.AddScheme<ApiKeyAuthenticationOptions, ApiKeyAuthenticationHandler>(name, options);
@@ -29,19 +35,27 @@ namespace Readarr.Http.Authentication
 
         public static AuthenticationBuilder AddAppAuthentication(this IServiceCollection services)
         {
-            return services.AddAuthentication()
+            services.AddOptions<CookieAuthenticationOptions>(AuthenticationType.Forms.ToString())
-                .AddNone(AuthenticationType.None.ToString())
+                .Configure<IConfigFileProvider>((options, configFileProvider) =>
-                .AddExternal(AuthenticationType.External.ToString())
-                .AddBasic(AuthenticationType.Basic.ToString())
-                .AddCookie(AuthenticationType.Forms.ToString(), options =>
                 {
-                    options.Cookie.Name = "ReadarrAuth";
+                    // Replace diacritics and replace non-word characters to ensure cookie name doesn't contain any valid URL characters not allowed in cookie names
+                    var instanceName = configFileProvider.InstanceName;
+                    instanceName = instanceName.RemoveDiacritics();
+                    instanceName = CookieNameRegex.Replace(instanceName, string.Empty);
+
+                    options.Cookie.Name = $"{instanceName}Auth";
                     options.AccessDeniedPath = "/login?loginFailed=true";
                     options.LoginPath = "/login";
                     options.ExpireTimeSpan = TimeSpan.FromDays(7);
                     options.SlidingExpiration = true;
                     options.ReturnUrlParameter = "returnUrl";
-                })
+                });
+
+            return services.AddAuthentication()
+                .AddNone(AuthenticationType.None.ToString())
+                .AddExternal(AuthenticationType.External.ToString())
+                .AddBasic(AuthenticationType.Basic.ToString())
+                .AddCookie(AuthenticationType.Forms.ToString())
                 .AddApiKey("API", options =>
                 {
                     options.HeaderName = "X-Api-Key";

src/Readarr.Http/Authentication/AuthenticationController.cs

@@ -47,7 +47,7 @@ namespace Readarr.Http.Authentication
 
             await HttpContext.SignInAsync(AuthenticationType.Forms.ToString(), new ClaimsPrincipal(new ClaimsIdentity(claims, "Cookies", "user", "identifier")), authProperties);
 
-            if (returnUrl.IsNullOrWhiteSpace())
+            if (returnUrl.IsNullOrWhiteSpace() || !Url.IsLocalUrl(returnUrl))
             {
                 return Redirect(_configFileProvider.UrlBase + "/");
             }

src/Readarr.Http/Middleware/UrlBaseMiddleware.cs

@@ -20,6 +20,8 @@ namespace Readarr.Http.Middleware
             if (_urlBase.IsNotNullOrWhiteSpace() && context.Request.PathBase.Value.IsNullOrWhiteSpace())
             {
                 context.Response.Redirect($"{_urlBase}{context.Request.Path}{context.Request.QueryString}");
+                context.Response.StatusCode = 307;
+
                 return;
             }