diff --git a/frontend/src/router/index.js b/frontend/src/router/index.js
index 6b5728b..42c8935 100644
--- a/frontend/src/router/index.js
+++ b/frontend/src/router/index.js
@@ -6,10 +6,10 @@ import {authStore} from '@/stores/auth'
 import {securityStore} from '@/stores/security'
 import {notify} from "@kyvg/vue3-notification";
 
-const routerBase = `${WGPORTAL_BASE_PATH || ''}${import.meta.env.BASE_URL || '/'}`
-
 const router = createRouter({
-  history: createWebHashHistory(routerBase),
+  // No base argument: createWebHashHistory() defaults to location.pathname + location.search,
+  // which is correct for /app/, {web.base_path}/app/ and the dev server at /.
+  history: createWebHashHistory(),
   routes: [
     {
       path: '/',
diff --git a/frontend/src/views/LoginView.vue b/frontend/src/views/LoginView.vue
index 3ac6dad..d6b1ff0 100644
--- a/frontend/src/views/LoginView.vue
+++ b/frontend/src/views/LoginView.vue
@@ -83,7 +83,10 @@ const externalLogin = function (provider) {
   console.log("Performing external login for provider", provider.Identifier);
   loggingIn.value = true;
   console.log(router.currentRoute.value);
-  const currentUrl = new URL(`${WGPORTAL_BASE_PATH || ''}${import.meta.env.BASE_URL || '/'}`, window.location.origin);
+  // Derive the return URL from the live document location, never from the build-time asset base
+  // (import.meta.env.BASE_URL): the app is mounted at {web.base_path}/app/ in production and at /
+  // under `npm run dev`, so window.location is the only reliable source.
+  const currentUrl = new URL(window.location.href);
   currentUrl.hash = router.currentRoute.value.fullPath;
   let currentUri = currentUrl.toString();
   let redirectUrl = `${WGPORTAL_BACKEND_BASE_URL}${provider.ProviderUrl}`;
diff --git a/internal/app/api/v0/handlers/endpoint_authentication.go b/internal/app/api/v0/handlers/endpoint_authentication.go
index 3b3f872..6ffbb96 100644
--- a/internal/app/api/v0/handlers/endpoint_authentication.go
+++ b/internal/app/api/v0/handlers/endpoint_authentication.go
@@ -208,6 +208,8 @@ func (e AuthEndpoint) handleOauthInitiateGet() http.HandlerFunc {
 
 		if returnTo != "" {
 			if !e.isValidReturnUrl(returnTo) {
+				slog.Debug("rejected invalid oauth return URL",
+					"provider", provider, "returnTo", returnTo, "expectedPrefix", e.frontendUrl(""))
 				respond.JSON(w, http.StatusBadRequest,
 					model.Error{Code: http.StatusBadRequest, Message: "invalid return URL"})
 				return
diff --git a/internal/app/api/v0/handlers/endpoint_authentication_basepath_test.go b/internal/app/api/v0/handlers/endpoint_authentication_basepath_test.go
index 872dc83..d5c773b 100644
--- a/internal/app/api/v0/handlers/endpoint_authentication_basepath_test.go
+++ b/internal/app/api/v0/handlers/endpoint_authentication_basepath_test.go
@@ -37,6 +37,9 @@ func newBasePathAuthEndpoint(session Session) AuthEndpoint {
 	}
 }
 
+// TestAuthEndpointIsValidReturnUrlRequiresBasePathApp pins the return URL shape that the frontend must
+// produce. The accepted values are generated by externalLogin() in frontend/src/views/LoginView.vue
+// from window.location - keep the two in sync when changing either side.
 func TestAuthEndpointIsValidReturnUrlRequiresBasePathApp(t *testing.T) {
 	ep := newBasePathAuthEndpoint(&testSession{})