fix: sanitizing the callback URL

Author: huamanraj

apps/web/src/app/providers.tsx

@@ -25,8 +25,8 @@ export function PostHogAuthTracker() {
     if (status === "loading") return;
 
     try {
-      // Check if PostHog is initialized
-      if (!posthog.__loaded) return;
+      // Check if PostHog is initialized using documented pattern
+      if (!posthog || typeof posthog.capture !== "function") return;
 
       // Detect transition from unauthenticated to authenticated
       const wasSignInInitiated =
@@ -46,19 +46,37 @@ export function PostHogAuthTracker() {
         if (isNewSignIn && !hasTrackedSignIn.current) {
           hasTrackedSignIn.current = true;
 
-          // Determine provider from stored value
-          const provider = storedProvider || "google"; // Default to google if unknown
+          // Validate provider to avoid skewing analytics
+          const validProviders = ["google", "github"];
+          const provider =
+            storedProvider && validProviders.includes(storedProvider)
+              ? storedProvider
+              : "unknown";
+
+          // Determine if this is a new user based on account creation time
+          // Consider a user "new" if their account was created within the last 5 minutes
+          let isNewUser = false;
+          if (session.user?.createdAt) {
+            try {
+              const createdAtTime = new Date(session.user.createdAt).getTime();
+              const now = Date.now();
+              const fiveMinutesInMs = 5 * 60 * 1000;
+              isNewUser = now - createdAtTime < fiveMinutesInMs;
+            } catch (error) {
+              console.error("[Analytics] Error parsing createdAt:", error);
+            }
+          }
 
           // Track sign-in completed EVENT only (no person properties)
           posthog.capture("sign_in_completed", {
             provider: provider,
-            is_new_user: false,
+            is_new_user: isNewUser,
           });
 
           if (process.env.NODE_ENV === "development") {
             console.log("[Analytics] Event tracked: sign_in_completed", {
               provider,
-              is_new_user: false,
+              is_new_user: isNewUser,
             });
           }
 
@@ -88,7 +106,7 @@ export function PostHogAuthTracker() {
 }
 
 /**
- * PostHog Provider 
+ * PostHog Provider
  * NOTE: This provider does NOT handle auth tracking.
  * Use PostHogAuthTracker inside SessionProvider for that.
  */

apps/web/src/components/login/SignInPage.tsx

@@ -34,14 +34,18 @@ const SignInPage = () => {
   const safeCallbackUrl = getSafeCallbackUrl(callbackUrl);
 
   const handleSignIn = (provider: "google" | "github") => {
-    // Track sign-in attempt
-    trackSignInStarted(provider, safeCallbackUrl);
+    // Sanitize callback URL to prevent leaking sensitive query params or tokens
+    const sanitizedCallback = safeCallbackUrl.split("?")[0].split("#")[0];
 
-    // Store provider and sign-in initiation for post-callback tracking
+    // Track sign-in attempt with sanitized callback (no query params or fragments)
+    trackSignInStarted(provider, sanitizedCallback);
+
+    // Store only provider and boolean flag for post-callback tracking
+    // Do NOT store the full callback URL to avoid leaking tokens/PII
     sessionStorage.setItem("posthog_sign_in_initiated", "true");
     sessionStorage.setItem("posthog_sign_in_provider", provider);
 
-    // Proceed with sign-in
+    // Proceed with sign-in (use the full safe callback for actual redirect)
     signIn(provider, { callbackUrl: safeCallbackUrl });
   };
 

apps/web/src/hooks/useAnalytics.ts

@@ -71,7 +71,9 @@ export function useAnalytics(): UseAnalyticsReturn {
 
     const isReady = useMemo(() => {
         try {
-            return posthog?.__loaded === true;
+            // Use optional chaining to safely check if PostHog is initialized
+            // This is the documented pattern instead of using __loaded
+            return !!posthog && typeof posthog.capture === 'function';
         } catch {
             return false;
         }

apps/web/src/lib/analytics.ts

@@ -135,12 +135,55 @@ export function truncateId(id: string): string {
     return `...${id.slice(-4)}`;
 }
 
+/**
+ * Sanitizes a callback URL by removing query parameters and fragments.
+ * This prevents leaking sensitive tokens, secrets, or PII in analytics.
+ * 
+ * @param url - The URL to sanitize
+ * @returns The pathname only (e.g., "/dashboard/home")
+ * 
+ * @example
+ * ```ts
+ * sanitizeCallbackUrl("/dashboard?token=abc123#section")
+ * // Returns: "/dashboard"
+ * ```
+ */
+export function sanitizeCallbackUrl(url: string): string {
+    if (!url || url.trim() === "") {
+        return "/dashboard/home";
+    }
+
+    try {
+        // If it's a relative URL (starts with /)
+        if (url.startsWith("/") && !url.startsWith("//")) {
+            // Remove query params and fragments
+            const pathOnly = url.split("?")[0].split("#")[0];
+            return pathOnly || "/dashboard/home";
+        }
+
+        // If it's an absolute URL, parse it
+        const parsedUrl = new URL(url, typeof window !== "undefined" ? window.location.origin : "https://example.com");
+        return parsedUrl.pathname || "/dashboard/home";
+    } catch {
+        // If parsing fails, return default
+        return "/dashboard/home";
+    }
+}
+
 /**
  * Checks if PostHog is initialized and ready.
+ * 
+ * Uses the public API pattern recommended by PostHog: checking if the capture
+ * method exists. This is safer than using the undocumented __loaded property.
+ * 
+ * Note: PostHog does not provide a dedicated isReady() or loaded() method.
+ * The recommended approach is to check for the existence of core methods.
+ * 
+ * @returns {boolean} True if PostHog is initialized and ready to use
  */
 export function isPostHogReady(): boolean {
     try {
-        return typeof posthog !== "undefined" && posthog.__loaded === true;
+        return typeof posthog !== "undefined" && typeof posthog.capture === "function";
     } catch {
         return false;
     }
@@ -343,6 +386,7 @@ export const analytics = {
     // Utility functions
     sanitizeAmount,
     truncateId,
+    sanitizeCallbackUrl,
 };
 
 export default analytics;

apps/web/src/lib/auth/config.ts

@@ -20,7 +20,7 @@ export const authConfig: NextAuthOptions = {
   callbacks: {
     async signIn({ user, profile, account }) {
       try {
-        await serverTrpc.auth.googleAuth.mutate({
+        const authResult = await serverTrpc.auth.googleAuth.mutate({
           email: user.email!,
           firstName: user.name ?? (profile as any)?.name,
           authMethod: account?.provider ?? "google",
@@ -33,6 +33,11 @@ export const authConfig: NextAuthOptions = {
           scope: account?.scope,
         });
 
+        // Store createdAt in user object for JWT callback
+        if (authResult?.user?.createdAt) {
+          (user as any).createdAt = authResult.user.createdAt;
+        }
+
         return true;
       } catch (error) {
         console.error("Sign-in error:", error);
@@ -41,6 +46,11 @@ export const authConfig: NextAuthOptions = {
     },
 
     async session({ session, token }) {
+      // Add createdAt from token to session
+      if (token.createdAt && session.user) {
+        session.user.createdAt = token.createdAt as string;
+      }
+
       return {
         ...session,
         accessToken: token.jwtToken,
@@ -56,6 +66,11 @@ export const authConfig: NextAuthOptions = {
           });
 
           token.jwtToken = data.token;
+
+          // Store createdAt in token if available
+          if ((user as any).createdAt) {
+            token.createdAt = new Date((user as any).createdAt).toISOString();
+          }
         } catch (error) {
           console.error("JWT token error:", error);
         }

apps/web/src/types/next-auth.d.ts

@@ -3,11 +3,18 @@ import "next-auth";
 declare module "next-auth" {
   interface Session {
     accessToken?: string;
+    user?: {
+      name?: string | null;
+      email?: string | null;
+      image?: string | null;
+      createdAt?: string;
+    };
   }
 }
 
 declare module "next-auth/jwt" {
   interface JWT {
     jwtToken?: string;
+    createdAt?: string;
   }
 }