[richiemcilroy]

Restricted share pages opened on a verified custom domain now redirect to the same /s/ page on the main web origin, so a viewer's existing Cap session decides access.

sequenceDiagram
  participant V as Viewer (signed in on cap.so)
  participant D as videos.example.com/s/id
  participant M as cap.so/s/id
  V->>D: open restricted video
  Note over D: session cookie is host-only on cap.so,<br/>so the viewer looks signed out here
  D-->>V: 307 to cap.so/s/id (query kept)
  V->>M: same request, with session cookie
  M-->>V: video, or the usual private / sign-in state

Loading

• Why: the session cookie belongs to the main origin, so a custom domain never knows who is watching. Before this change, every private or email-restricted video on a custom domain showed "This video is private" with a Sign in button. That button led to a login form even for viewers who were already signed in.
• What: the share page's PolicyDenied handler checks the request host. On a verified custom domain it returns a redirect to the main origin instead of the denied state (apps/web/app/s/[videoId]/page.tsx:260, :468).
• resolveRestrictedShareRedirect (apps/web/lib/share-web-url.ts:100) reuses resolveShareWebUrl. The main origin returns null without a database lookup, so there is no redirect loop. Unknown or unverified hosts also return null. The video id is encoded as a single path segment, and every query parameter is preserved, including repeated keys.
• Unchanged:
  • public videos, which still play on the custom domain
  • password gates (VerifyVideoPasswordError), which stay on the custom domain
  • missing and pending videos
  • share metadata
  • authorized views, which never reach the host lookup
• redirect() throws, so it runs after the Effect resolves. The denied branch returns a { redirectTo } marker rather than throwing inside the Effect.

Confidence Score: 5/5

The PR appears safe to merge; no actionable issues were found.

Summary

Restricted share pages on verified custom domains now send viewers to the main origin, where their existing session decides access.

• Restricted share pages on verified custom domains now use Cap’s main origin.

No actionable issues were found.

_{Reviews (2) · Last reviewed commit: "fix(web): send restricted custom-domain ..." · Reviewed by Greptile}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
cap-status	Skipped		Oct 29, 2026 12:50pm UTC

[richiemcilroy]

hey @greptileai, please re-review the PR

[capy-ai]

Capy found no issues.

View 1 other finding in Capy.