@@ -266,16 +266,27 @@ private static function writeJson(array $data): void
     }
 
     /**
-     * Get the path of the current URL, without the query string.
+     * Get the path of the current URL, without the query string (or with the query of the page).
      *
      * Always same-origin: a request for `//evil.example/` (which a front controller may route to the script)
      * would otherwise give a protocol-relative URL, pointing redirects and the QR code requests to another
      * host.
      */
-    public static function getSelfUrl(): string
+    public static function getSelfUrl(bool $withQuery = false): string
     {
-        $path = explode('?', $_SERVER['REQUEST_URI'] ?? '', 2)[0];
-        return '/'.ltrim(str_replace('\\', '/', $path), '/');
+        [$path, $query] = explode('?', $_SERVER['REQUEST_URI'] ?? '', 2) + [1 => ''];
+        $path = '/'.ltrim(str_replace('\\', '/', $path), '/');
+        if (!$withQuery) {
+            return $path;
+        }
+        // The query of the page, which may select the session or the bot (index.php?bot=x), without the
+        // parameters of the web UI: as is (parse_str() would rename the parameters with dots or spaces)
+        $query = implode('&', array_filter(
+            explode('&', $query),
+            static fn (string $pair): bool => $pair !== ''
+                && !\in_array(urldecode(explode('=', $pair, 2)[0]), ['getQrCode', 'waitQrCodeOrLogin', self::ASSET_PARAMETER], true),
+        ));
+        return $query === '' ? $path : "$path?$query";
     }
 
     /**
 
@@ -57,6 +57,17 @@ trait Start
     public function start(): array
     {
         if ($this->getAuthorization() === \danog\MadelineProto\API::LOGGED_IN) {
+            // Requests of the web UI that come after the login (a late QR code poll, a form submitted twice, or
+            // from another tab): they're answered here, the script must not run in them (it runs in the page)
+            if (PHP_SAPI !== 'cli' && PHP_SAPI !== 'phpdbg') {
+                if (isset($_GET['waitQrCodeOrLogin']) || isset($_GET['getQrCode'])) {
+                    $this->webQrLogin();
+                    die;
+                }
+                if (WebUI::writeLoggedIn()) {
+                    die;
+                }
+            }
             return $this instanceof Client ? $this->getSelf() : $this->fullGetSelf();
         }
         if (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg') {
@@ -280,7 +291,7 @@ private function getWebLoginPage(): ?Page
                     ],
                     submit: Lang::$current_lang['webContinue'],
                     alerts: $alerts,
-                    qrEndpoint: WebUI::getSelfUrl(),
+                    qrEndpoint: WebUI::getSelfUrl(true),
                 );
             case API::WAITING_CODE:
                 return new Page(
 
@@ -293,6 +293,18 @@ public function testSelfUrlIsAlwaysSameOrigin(): void
                 $_SERVER['REQUEST_URI'] = $requestUri;
                 self::assertSame($expected, WebUI::getSelfUrl());
             }
+            // With the query of the page (which may select the session), without the parameters of the web UI
+            foreach ([
+                '/index.php?bot=a&getQrCode' => '/index.php?bot=a',
+                '/index.php?waitQrCodeOrLogin=&x=1' => '/index.php?x=1',
+                '/index.php?getQrCode' => '/index.php',
+                '/index.php?madelineAsset=assets/tweb/app.js&bot=a' => '/index.php?bot=a',
+                '//evil.example/x?bot=a' => '/evil.example/x?bot=a',
+                '/index.php?bot.name=a%20b&getQrCode' => '/index.php?bot.name=a%20b',
+            ] as $requestUri => $expected) {
+                $_SERVER['REQUEST_URI'] = $requestUri;
+                self::assertSame($expected, WebUI::getSelfUrl(true));
+            }
         } finally {
             if ($uri === null) {
                 unset($_SERVER['REQUEST_URI']);
 
@@ -39,6 +39,13 @@ describe('submitForm', () => {
     expect(await submitForm({app_title: 'x', app_shortname: 'xxxxx'})).toEqual({loggedIn: true});
   });
 
+  it('fails on HTTP errors, rather than taking an error page of PHP or of a proxy for a login', async() => {
+    vi.stubGlobal('fetch', vi.fn(() => respond('<html>Fatal error</html>', 'text/html', 500)));
+    await expect(submitForm({phone_code: '12345'})).rejects.toThrow('HTTP 500');
+    vi.stubGlobal('fetch', vi.fn(() => respond('Bad gateway', 'text/plain', 502)));
+    await expect(submitForm({phone_code: '12345'})).rejects.toThrow('HTTP 502');
+  });
+
   it('marks the submission as pending while it runs', async() => {
     let resolve: (response: Response) => void;
     vi.stubGlobal('fetch', vi.fn(() => new Promise<Response>((r) => resolve = r)));
@@ -60,6 +67,13 @@ describe('pollQr', () => {
     expect(fetch.mock.calls[0][1].redirect).toBe('error');
   });
 
+  it('keeps the query of the page, which may select the session', async() => {
+    const fetch = vi.fn(() => respond({logged_in: false, link: 'tg://login?token=a'}));
+    vi.stubGlobal('fetch', fetch);
+    await pollQr('/index.php?bot=a', 'waitQrCodeOrLogin');
+    expect((fetch.mock.calls[0] as unknown[])[0]).toBe(window.location.origin + '/index.php?bot=a&waitQrCodeOrLogin');
+  });
+
   it('never asks another origin', async() => {
     const fetch = vi.fn(() => respond({}));
     vi.stubGlobal('fetch', fetch);
 
@@ -24,8 +24,8 @@ function pageUrl() {
  * POST the fields to the script, as the form of the server-rendered page would.
  *
  * `{state}`: the next page (or the same one, with an error). `{loggedIn}`: the login is over, and the
- * user's script runs in the GET of the reload; any answer that isn't JSON means the same (the script
- * printed its own page).
+ * user's script runs in the GET of the reload; any successful answer that isn't JSON means the same (the
+ * script printed its own page). A failed one (an error of PHP, of a proxy) is an error, not a login.
  */
 export async function submitForm(fields: Record<string, string>): Promise<SubmitResult> {
   submitted = true;
@@ -41,6 +41,10 @@ export async function submitForm(fields: Record<string, string>): Promise<Submit
       body: new URLSearchParams(fields)
     });
 
+    if(!response.ok) {
+      throw new Error('HTTP ' + response.status);
+    }
+
     if(!(response.headers.get('Content-Type') || '').includes('application/json')) {
       return {loggedIn: true};
     }
@@ -76,8 +80,9 @@ export async function pollQr(endpoint: string, query: 'getQrCode' | 'waitQrCodeO
     throw new Error('The QR code endpoint is on another origin');
   }
 
-  // the validated URL itself: a path starting with `//`, fetched on its own, would be another host
-  url.search = '?' + query;
+  // the validated URL itself: a path starting with `//`, fetched on its own, would be another host. With the
+  // query of the page, which may select the session or the bot (index.php?bot=x)
+  url.search = url.search ? url.search + '&' + query : '?' + query;
   url.hash = '';
   const response = await fetch(url.href, {credentials: 'same-origin', cache: 'no-store', redirect: 'error', signal});
   if(!response.ok) {
 
@@ -34,9 +34,8 @@ export function isEmptyText(text: Text | null | undefined): boolean {
 
 function textContent(text: Text): string {
   if(typeof(text) === 'string') return text;
-  const div = document.createElement('div');
-  div.innerHTML = text.html;
-  return div.textContent;
+  // parsed in an inert document: nothing in it loads or runs
+  return new DOMParser().parseFromString(text.html, 'text/html').body.textContent ?? '';
 }
 
 /**