Open Closed

Admin Console's "Back to the application" link returns the user to the Admin Console, so the account pages are a dead end #10848


User avatar
0
severances@gc.adventist.org created
  • ABP Framework version: v10.6.0 (Volo.Abp.AdminConsole 10.6.0); also reproduced in 10.5.0 and 10.4.1
  • UI Type: React
  • Database System: EF Core (SQL Server)
  • Tiered (for MVC) or Auth Server Separated (for Angular): no — single host (API + OpenIddict auth server)
  • Exception message and full stack trace: none. Nothing fails; the link simply goes to the wrong place.
  • Steps to reproduce the issue: below.

Summary

In the Admin Console, "Back to the application" navigates to the Admin Console.

The link is compiled as a client-router link to the router root:

(0,V.jsx)(w,{to:`/`,children:e(`AbpUi::BackToTheApplication`)})

and the router's basepath is /admin-console, so to: "/" resolves to the console's own root. For a solution whose application is a separate front end — which is the shape abp new scaffolds for UI type React — the console is precisely not the application, and the link is the only affordance offering to take the user back to it.

This matters more than a mislabelled link because the account pages live inside the console: my profile, change password, two-factor, sessions, linked accounts, external logins, security logs, personal data. Our application sends ordinary end users there — they have no other way to change their own password — and the account layout offers no other navigation. Its sidebar contains the account links and this one link out. So once a non-administrator opens My account, "Back to the application" is the only way out of the console, and it does not lead out of the console.

This is not a PathBase issue and does not need a sub-path deployment to reproduce; it is unrelated to the sub-path defects we reported in #10823 and its follow-up, beyond sharing the underlying assumption that the console is the whole application.

Steps to reproduce

  1. Create an ABP solution with UI type React, so the application and the Admin Console are separate front ends (in our case the SPA is at https://example.org/app and the ABP host at https://example.org/app/backend).
  2. Sign in to the application as a user without AdminConsole.Access.
  3. From the application, open an account page — …/admin-console/account/manage.
  4. Click Back to the application.

Expected: the browser returns to the application the user came from.

Actual: the browser navigates to …/admin-console, the Admin Console root. For a user without AdminConsole.Access that is the console's own 403 page, whose only affordance is the same link.

The same link appears on the console's 403 page and in the "you are already logged in" card, with the same target.

Where it occurs

Four occurrences in the shipped bundle, identical in shape across 10.4.1, 10.5.0 and 10.6.0:

| Chunk | Surface | |---|---| | main-*.js | The account layout's sidebar link — the one an end user meets | | main-*.js | The centred auth layout's footer link | | main-*.js | The console's own 403 page | | LoginPage-*.js | The "you are already logged in" card |

Two further uses of AbpUi::BackToTheApplication are, we believe, correct as they are and are worth preserving if you change this:

  • ForgotPasswordPage-*.js targets /account/login — deliberately inside the console.
  • LowCodeDesignerShell-*.js targets the console root, which for a full-screen designer is the application it belongs to.

Suggested fix, which is your own documented pattern

docs/en/low-code/non-react-ui-integration.md → "Add Back to the Application" already prescribes exactly this for a React runtime hosted beside an existing application:

<Button variant="ghost" size="sm" asChild>
  <a href={getHostApplicationUrl()}>
    <ArrowLeft className="size-4" />
    <span>{t('AbpUi::BackToTheApplication')}</span>
  </a>
</Button>

— a plain anchor performing a full-page navigation to a configured application.returnUrl, read from the runtime config. The packaged Admin Console does not follow it, and cannot: its runtime config (admin-console/api/config) exposes an application object with name and logoUrl and no returnUrl.

So the fix looks like two small things:

  1. Add application.returnUrl to the console's runtime config, populated from a configuration key — AbpAdminConsoleOptions would be the natural home, and ABP already knows the value: AppUrlOptions.Applications["React"].RootUrl, which the framework uses to build password-reset and email-confirmation links, is the same URL.
  2. Render the four links above as anchors to it, falling back to today's behaviour when it is not configured — so a solution where the host is the application is unaffected.

What we do meanwhile, in case it is useful

We rewrite those four links in the served bundle to plain anchors at our SPA's root, in middleware. It has held across 10.4.1, 10.5.0 and 10.6.0 — including the 10.6.0 chunk restructure — because it matches on shape rather than on your asset names. But it is a regular expression over minified third-party JavaScript: a new prop containing a nested object literal, a different route target, or a rename of the localization key each silently stops it matching, and the link reverts to the behaviour above. We gate it with a build-time assertion that exactly four occurrences still match in your shipped package, so an upgrade fails our build rather than quietly regressing for users. That is a tripwire, not a fix, and we would much rather delete the whole thing.

Environment note

Our deployment is an IIS virtual application under a path prefix, which is the context of our earlier reports. It is not relevant here — the link targets the console's own root in every hosting shape, including a plain dotnet run on localhost with no prefix at all. We mention it only so the two are not conflated.

Markdown supported.
Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

3 Answer(s)
  • User Avatar
    0
    AI-Bot created
    Support Team ABP Agent
    • With ABP Volo.Abp.AdminConsole 10.4.x–10.6.x (including 10.6.0), the Admin Console React UI renders “Back to the application” as a client-side router link to /. Since the Admin Console router is mounted with basepath = /admin-console, that navigation resolves to /admin-console, not to your separate React SPA. In other words: in these versions there is no built-in “return URL” concept for that link in the shipped Admin Console bundle.

    • The Admin Console runtime configuration endpoint (/admin-console/api/config) (as documented) exposes Admin Console options like enabling/disabling, redirecting / to /admin-console, authority/client id/scope, theme, localization, etc., but it does not document (or provide) an application.returnUrl that the built-in UI could use for this link. So there is nothing you can configure today (in 10.6.0) to make that link point back to your separate React app.

    • Practical, supportable workaround (backend-side) that avoids patching minified JS:

      1. Disable the “redirect backend root to admin-console” behavior so that / is not the Admin Console entry point:
        • Set AdminConsole:RedirectRootToAdminConsole to false (or the equivalent AbpAdminConsoleOptions.RedirectRootToAdminConsole = false).
      2. Then ensure your backend root / (or a dedicated endpoint like /return-to-app) performs an HTTP redirect to your SPA root (e.g. /app) — using your own controller/middleware.
        • This way, even if the Admin Console navigates to /admin-console (or to / under certain conditions), you can control what / does and make it “go back to the application”.
    • If you want the behavior you described (“application.returnUrl from runtime config + render as <a href=...>”), that matches the documented pattern in the “Non React UI Integration” document, but Admin Console does not currently implement that pattern in the shipped package versions you tested.

    Sources:

    • https://abp.io/docs/10.6/framework/ui/react/admin-console
    • https://abp.io/docs/10.6/framework/infrastructure/app-urls
    • https://abp.io/docs/latest/low-code/non-react-ui-integration

    This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    severances@gc.adventist.org created

    This is a bug report. Having a back to application link that is broken out of the box isn't ideal--especially if the fix involves altering minified code.

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    maliming created
    Support Team Fullstack Developer

    Hi,

    You're right, this is a bug on our side.

    Until the fix ships, open the account pages from your SPA in a new tab, so closing the tab is the way back for the users you send there:

    <a
      href={`${backendUrl}/admin-console/account/manage`}
      target="_blank"
      rel="noopener noreferrer"
    >
      {t('AbpAccount::MyAccount')}
    </a>
    

    The next version fixes it the way you suggested — set the application url and those links become plain anchors to it:

    {
      "AdminConsole": {
        "ReturnUrl": "https://example.org/app"
      }
    }
    

    Your ticket has been refunded.

    Thanks

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
Boost Your Development
ABP Live Training
Packages
See Trainings
Mastering ABP Framework Book
The Official Guide
Mastering
ABP Framework
Learn More
Mastering ABP Framework Book
Made with ❤️ on ABP v10.8.0-preview. Updated on September 23, 2026, 09:57
1
ABP Assistant
🔐 You need to be logged in to use the chatbot. Please log in first.