diff --git a/striker-ui-api/src/lib/assertAuthentication.ts b/striker-ui-api/src/lib/assertAuthentication.ts
index b9d17afc..e1a268f2 100644
--- a/striker-ui-api/src/lib/assertAuthentication.ts
+++ b/striker-ui-api/src/lib/assertAuthentication.ts
@@ -2,10 +2,19 @@ import { Handler } from 'express';
 
 import { stdout } from './shell';
 
+type HandlerParameters = Parameters<Handler>;
+
+type AssertAuthenticationFailFunction = (
+  returnTo?: string,
+  ...args: HandlerParameters
+) => void;
+
+type AssertAuthenticationSucceedFunction = (...args: HandlerParameters) => void;
+
 type AssertAuthenticationOptions = {
-  fail?: string | ((...args: Parameters<Handler>) => void);
+  fail?: string | AssertAuthenticationFailFunction;
   failReturnTo?: boolean | string;
-  succeed?: string | ((...args: Parameters<Handler>) => void);
+  succeed?: string | AssertAuthenticationSucceedFunction;
 };
 
 type AssertAuthenticationFunction = (
@@ -13,42 +22,47 @@ type AssertAuthenticationFunction = (
 ) => Handler;
 
 export const assertAuthentication: AssertAuthenticationFunction = ({
-  fail: initFail = (request, response) => response.status(404).send(),
+  fail: initFail = (rt, rq, response) => response.status(404).send(),
   failReturnTo,
   succeed: initSucceed = (request, response, next) => next(),
 }: AssertAuthenticationOptions = {}) => {
-  const fail: (...args: Parameters<Handler>) => void =
+  let getReturnTo: ((...args: HandlerParameters) => string) | undefined;
+
+  if (failReturnTo === true) {
+    getReturnTo = ({ path }) => path;
+  } else if (typeof failReturnTo === 'string') {
+    getReturnTo = () => failReturnTo;
+  }
+
+  const fail: AssertAuthenticationFailFunction =
     typeof initFail === 'string'
-      ? (request, response) => response.redirect(initFail)
+      ? (returnTo, rq, response) =>
+          response.redirect(returnTo ? `${initFail}?rt=${returnTo}` : initFail)
       : initFail;
 
-  const succeed: (...args: Parameters<Handler>) => void =
+  const succeed: AssertAuthenticationSucceedFunction =
     typeof initSucceed === 'string'
       ? (request, response) => response.redirect(initSucceed)
       : initSucceed;
 
-  let getReturnTo: ((...args: Parameters<Handler>) => string) | undefined;
-
-  if (failReturnTo === true) {
-    getReturnTo = ({ originalUrl, url }) => originalUrl || url;
-  } else if (typeof failReturnTo === 'string') {
-    getReturnTo = () => failReturnTo;
-  }
-
   return (...args) => {
     const { 0: request } = args;
-    const { originalUrl, session } = request;
+    const { path, session } = request;
     const { passport } = session;
 
     if (passport?.user) return succeed(...args);
 
-    session.returnTo = getReturnTo?.call(null, ...args);
+    const rt = getReturnTo?.call(null, ...args);
+
+    stdout(`Unauthenticated access to ${path}`);
+
+    if (rt) {
+      stdout(`Set session.returnTo=${rt}`);
 
-    stdout(
-      `Unauthenticated access to ${originalUrl}; set return to ${session.returnTo}`,
-    );
+      session.returnTo = rt;
+    }
 
-    return fail(...args);
+    return fail(rt, ...args);
   };
 };
 
diff --git a/striker-ui-api/src/routes/static.ts b/striker-ui-api/src/routes/static.ts
index 414f8195..7538332f 100644
--- a/striker-ui-api/src/routes/static.ts
+++ b/striker-ui-api/src/routes/static.ts
@@ -19,9 +19,10 @@ router.use(
     if (/^[/]login/.test(originalUrl)) {
       stdout(`Static:login requested`);
 
-      return assertAuthentication({ fail: (rq, rs, nx) => nx(), succeed: '/' })(
-        ...args,
-      );
+      return assertAuthentication({
+        fail: (rt, rq, rs, nx) => nx(),
+        succeed: '/',
+      })(...args);
     }
 
     const parts = originalUrl.replace(/[/]$/, '').split('/');