"next" link incorrect when `app_root` is set

[arashdalir]

Bug description

1. set APPLICATION_ROOT to /mypath
2. run superset.
3. login page pops up with the correct path, BUT the next value is incorrectly set: /mypath/login/?next=%2Fsuperset%2Fwelcome%2F. it should include /mypath inside it.
4. login and you land on nowhere.

Screenshots/recordings

No response

Superset version

6.0.0

Python version

3.11

Node version

I don't know

Browser

Chrome

Additional context

note:
because of our special/ specific needs, our main application looks like this.

from superset.app import create_app
import sys

root_path = sys.argv[1] if len(sys.argv) > 1 else None
app = create_app(superset_app_root=root_path)

# our use-case-specific code

if __name__ == "__main__":
    serve(app, host='0.0.0.0', port='8200', threads=16,)

and the script is executed in the venv using python app.py /mypath

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot]

Hi @arashdalir! I'm Dosu and I’m helping the superset team.

@arashdalir this is a known bug in the redirect_to_login function — it uses request.path / request.full_path directly without prepending request.script_root, so the next parameter ends up missing the app root prefix [1].

This was fixed in PR #37942 (merged February 18, 2026), which changes the redirect target construction to:

target = request.script_root + request.full_path.rstrip("?")
# instead of just
target = request.full_path.rstrip("?")

This is one of several post-6.0.0 fixes for SUPERSET_APP_ROOT handling — the same class of bug affected user info navigation, dashboard export URLs, and static assets [2]. The feature is still marked as BETA with some remaining edge cases around OAuth/LDAP login and Swagger UI [3].

To resolve this, you'll need to either:

1. Upgrade to a Superset version that includes PR fix: Include app_root in next param #37942, or
2. Cherry-pick / backport the fix to superset/views/utils.py in your deployment

Also, make sure your configuration includes STATIC_ASSETS_PREFIX and proxy fix settings if you're behind a reverse proxy [4]:

SUPERSET_APP_ROOT = "/mypath"
STATIC_ASSETS_PREFIX = "/mypath"
ENABLE_PROXY_FIX = True

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.