diff --git a/app/src/auth/authenticate/Authenticator.ts b/app/src/auth/authenticate/Authenticator.ts
index 6632a6f5..894f09a1 100644
--- a/app/src/auth/authenticate/Authenticator.ts
+++ b/app/src/auth/authenticate/Authenticator.ts
@@ -215,7 +215,7 @@ export class Authenticator<Strategies extends Record<string, Strategy> = Record<
       throw new Exception("Invalid response");
    }
 
-   private async respondWithError(c: Context, error: Error, opts?: AuthResolveOptions) {
+   async respondWithError(c: Context, error: Error, opts?: AuthResolveOptions) {
       $console.error("respondWithError", error);
       if (this.isJsonRequest(c) || opts?.forceJsonResponse) {
          // let the server handle it
@@ -224,7 +224,7 @@ export class Authenticator<Strategies extends Record<string, Strategy> = Record<
 
       await addFlashMessage(c, String(error), "error");
 
-      const referer = opts?.redirect ?? c.req.header("Referer") ?? "/";
+      const referer = this.getSafeUrl(c, opts?.redirect ?? c.req.header("Referer") ?? "/");
       return c.redirect(referer);
    }
 
diff --git a/app/src/auth/authenticate/strategies/PasswordStrategy.ts b/app/src/auth/authenticate/strategies/PasswordStrategy.ts
index 3031d636..706e14be 100644
--- a/app/src/auth/authenticate/strategies/PasswordStrategy.ts
+++ b/app/src/auth/authenticate/strategies/PasswordStrategy.ts
@@ -85,37 +85,49 @@ export class PasswordStrategy extends Strategy<typeof schema> {
       const payloadSchema = this.getPayloadSchema();
 
       hono.post("/login", tb("query", redirectQuerySchema), async (c) => {
-         const body = parse(payloadSchema, await authenticator.getBody(c), {
-            onError: (errors) => {
-               $console.error("Invalid login payload", [...errors]);
-               throw new InvalidCredentialsException();
-            },
-         });
-         const { redirect } = c.req.valid("query");
+         try {
+            const body = parse(payloadSchema, await authenticator.getBody(c), {
+               onError: (errors) => {
+                  $console.error("Invalid login payload", [...errors]);
+                  throw new InvalidCredentialsException();
+               },
+            });
+            const { redirect } = c.req.valid("query");
 
-         return await authenticator.resolveLogin(c, this, body, this.verify(body.password), {
-            redirect,
-         });
+            return await authenticator.resolveLogin(c, this, body, this.verify(body.password), {
+               redirect,
+            });
+         } catch (e) {
+            return authenticator.respondWithError(c, e as any);
+         }
       });
 
       hono.post("/register", tb("query", redirectQuerySchema), async (c) => {
-         const { redirect } = c.req.valid("query");
-         const { password, email, ...body } = parse(payloadSchema, await authenticator.getBody(c), {
-            onError: (errors) => {
-               $console.error("Invalid register payload", [...errors]);
-               throw new InvalidCredentialsException();
-            },
-         });
+         try {
+            const { redirect } = c.req.valid("query");
+            const { password, email, ...body } = parse(
+               payloadSchema,
+               await authenticator.getBody(c),
+               {
+                  onError: (errors) => {
+                     $console.error("Invalid register payload", [...errors]);
+                     new InvalidCredentialsException();
+                  },
+               },
+            );
 
-         const profile = {
-            ...body,
-            email,
-            strategy_value: await this.hash(password),
-         };
+            const profile = {
+               ...body,
+               email,
+               strategy_value: await this.hash(password),
+            };
 
-         return await authenticator.resolveRegister(c, this, profile, async () => void 0, {
-            redirect,
-         });
+            return await authenticator.resolveRegister(c, this, profile, async () => void 0, {
+               redirect,
+            });
+         } catch (e) {
+            return authenticator.respondWithError(c, e as any);
+         }
       });
 
       return hono;