543c9ee045ba1832faaa9b75c6dc1e369dffce5a
max
  Thu Sep 10 05:21:42 2026 -0700
Login and Sign out come back to a page that was reached by POST, refs #38192

Clicking a track name in the list below the browser image submits the
hgTracks form to hgTrackUi, so the request is a POST even though the
track name sits in the URL. The return URL builder threw the query
string away for anything that was not a GET, which left a returnto of
hgTrackUi?hgsid= alone, and hgTrackUi cannot draw a page from that
because the track name is deliberately not kept in the cart. Login and
Sign out therefore ended in an error instead of coming back.

The query string of a POST lives in the form's action URL, which is the
address the browser is showing, so returning to it is no different from
the visitor pressing reload. Only the form body is left behind, and the
cart already holds what mattered from it. hgTracks stays the exception:
its query string can hold a one-shot zoom or drag.

Also, hgTrackUi now says which parameter is missing when it is reached
without a track name, rather than failing on a bare hash lookup, and
hgCollection's own "you must be logged in" link brings the visitor back
to hgCollection instead of the sessions page.

diff --git src/hg/hgCollection/hgCollection.c src/hg/hgCollection/hgCollection.c
index 0086624f35d..454b7f74aac 100644
--- src/hg/hgCollection/hgCollection.c
+++ src/hg/hgCollection/hgCollection.c
@@ -995,31 +995,39 @@
 if (!trackHubDatabase(db))
     conn = hAllocConn(db);
 saveTrackName(newTdb, hubName, NULL);
 printTrackDbListToHub(db, conn, f, hubName, trackList, collectionName, newTdb,  0, 0);
 
 hFreeConn(&conn);
 fclose(f);
 }
 
 static void doMiddle(struct cart *cart)
 /* Set up globals and make web page */
 {
 char *userName = (loginSystemEnabled() || wikiLinkEnabled()) ? wikiLinkUserName() : NULL;
 
 if (userName == NULL)
-    errAbort("You must be logged in to edit collections. Visit our <A HREF=\"hgLogin?hgLogin.do.displayLoginPage=1\">login page.</A>");
+    {
+    // Send them back here once they are logged in, rather than to the sessions page
+    char *hgsid = cartSessionId(cart);
+    char *retEnc = wikiLinkEncodeCurrentPageReturnUrl(hgsid);
+    char *loginUrl = retEnc ? wikiLinkUserLoginUrlReturning(hgsid, retEnc)
+                            : wikiLinkUserLoginUrl(hgsid);
+    errAbort("You must be logged in to edit collections. Visit our "
+             "<A HREF=\"%s\">login page.</A>", loginUrl);
+    }
 
 char *db;
 char *genome;
 getDbAndGenome(cart, &db, &genome, oldVars);
 initGenbankTableNames(db);
 int timeout = cartUsualInt(cart, "udcTimeout", 300);
 if (udcCacheTimeout() < timeout)
     udcSetCacheTimeout(timeout);
 knetUdcInstall();
 
 struct trackDb *trackList;
 struct grp *groupList;
 cartTrackDbInit(cart, &trackList, &groupList, TRUE);
 pruneTrackList(&trackList, &groupList);