diff --git a/application/controllers/Login.php b/application/controllers/Login.php
index 8a2d3ce5..8966ef6d 100644
--- a/application/controllers/Login.php
+++ b/application/controllers/Login.php
@@ -90,10 +90,19 @@ class Login extends CI_Controller {
 
                 if ($page) {
                     setcookie('derniere_page','',time()-3600,'/');
-                    header("Location: ".$page);
+                    // Path only — rester sur le host où on s’est logué (pas prod via URL absolue).
+                    if (preg_match('#^https?://#i', $page)) {
+                        $parts = parse_url($page);
+                        $page = ($parts['path'] ?? '/')
+                            . (isset($parts['query']) ? '?'.$parts['query'] : '');
+                    }
+                    if ($page === '' || $page[0] !== '/') {
+                        $page = '/';
+                    }
+                    header('Location: '.$page);
                     exit;
                 }
-                    redirect('/');
+                redirect('/');
 
             }
 
diff --git a/v4_ci4/app/Config/Filters.php b/v4_ci4/app/Config/Filters.php
index 5f075a7d..82a5fdc1 100644
--- a/v4_ci4/app/Config/Filters.php
+++ b/v4_ci4/app/Config/Filters.php
@@ -73,8 +73,7 @@ class Filters extends BaseFilters
      */
     public array $globals = [
         'before' => [
-            // TEMP DEV (soirée test) — Radar sans auth. Remettre auth strict après.
-            'auth' => ['except' => ['radar', 'radar/*']],
+            'auth',
             // 'honeypot',
             // 'csrf',
             // 'invalidchars',