Use devise stored_location to redirect after signing for both public and private pages.

app/controllers/application_controller.rb

@@ -68,7 +68,7 @@ class ApplicationController < ActionController::Base
       flash[:alert] = "Your account is blocked. Retry when an admin has unblocked it."
       new_user_session_path
     else
-      super
+      stored_location_for(:redirect) || stored_location_for(resource) || root_path
     end
   end
 

app/controllers/sessions_controller.rb

+class SessionsController < Devise::SessionsController
+
+  def new
+    if request.referer.present?
+      store_location_for(:redirect, URI(request.referer).path)
+    end
+
+    super
+  end
+
+  def create
+    super
+  end
+end

config/routes.rb

@@ -160,7 +160,7 @@ Gitlab::Application.routes.draw do
 
   resources :projects, constraints: { id: /[^\/]+/ }, only: [:new, :create]
 
-  devise_for :users, controllers: { omniauth_callbacks: :omniauth_callbacks, registrations: :registrations , passwords: :passwords}
+  devise_for :users, controllers: { omniauth_callbacks: :omniauth_callbacks, registrations: :registrations , passwords: :passwords, sessions: :sessions }
 
   devise_scope :user do
     get "/users/auth/:provider/omniauth_error" => "omniauth_callbacks#omniauth_error", as: :omniauth_error