This issue was a duplicate of 📌 [PHP8.1] Deprecated function: str_replace(): Passing null to parameter #2 ($replace) of type array|string is deprecated in Drupal\Core\Access\RouteProcessorCsrf->processOutbound() Fixed but the patch included additional test coverage for placing a flag link on an arbitrary page and verifying that non-javascript browsers are redirected back to the original page after setting/unsetting the flag.
The test only patch from #8 should still apply.
The non-javascript fallback link has an empty destination parameter. This mostly only affects integration tests without javascript.
Clicking on an AJAX link on any page other than the flagged entity's canonical route with javascript disabled does not redirect back to the original page.
It looks like there's a missing return statement in AJAXActionLink::getDestination() which could be the culprit. I'll create a patch and test that later today.
Needs work
4.0
User interface
The patch will have to be re-rolled with new suggestions/changes described in the comments in the issue.
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.