Resilient Redirects: Cross-Hub Auth

Bypassing the Loop

Cross-hub redirects are one of the most technically fragile interactions in a multi-tenant, reverse-proxied architecture. When a user navigates from one micro-frontend to another, the authentication layer must validate their session, generate a cross-hub token, and redirect the user correctly — all without triggering an infinite redirect loop.

In our previous architecture, this process was managed by Next.js client-side routing, introducing 308 Permanent Redirect ghosts — cached redirects that caused certain navigation paths to loop indefinitely.

The Root Cause

• Redirect Chain Caching: next/link and the browser both cached the initial 308 response from a failed auth check, meaning subsequent navigations continued to follow the stale redirect without re-validating the session.
• BasePath Double-Injection: The route construction logic concatenated the micro-frontend's basePath with a destination URL that already included it, creating a malformed path that the backend rejected with a 308 redirect to root.

The Resolution

1. 1.window.location.assign Replacement: All cross-hub redirects now use window.location.assign with a fully constructed, absolute URL rather than a Next.js router.push call, bypassing the client-side caching layer entirely.
2. 2.Single-Source BasePath Resolution: A new buildCrossHubUrl utility function is the single source of truth for constructing cross-hub URLs, eliminating all potential for double-injection.
3. 3.Session Pre-validation: The middleware now performs a lightweight session pre-validation before initiating any redirect, ensuring only valid sessions generate redirect URLs.

Zero Ghost Redirects

Since deploying these changes, the cross-hub authentication flow has recorded zero ghost redirect incidents in production monitoring. Users move between platform hubs with deterministic, cache-safe redirects, and the authentication handoff is invisible — exactly as it should be.