diff --git a/console/templates/console-spice-full.html b/console/templates/console-spice-full.html
index 5be3967d..b92c5745 100644
--- a/console/templates/console-spice-full.html
+++ b/console/templates/console-spice-full.html
@@ -61,8 +61,8 @@
             sc.stop();
         }
 
-        var path = '{{ ws_path }}';
-        uri = scheme + "{{ ws_host }}:{{ ws_port }}" + (path ? (path[0] == '/' ? path : ('/' + path)) : '/');
+        var path = '{{ ws_path|escapejs }}';
+        uri = scheme + '{{ ws_host|escapejs }}:{{ ws_port|default:6080 }}' + (path ? (path[0] == '/' ? path : ('/' + path)) : '/');
 
         document.getElementById('connectButton').innerHTML = "Stop";
         document.getElementById('connectButton').onclick = disconnect;
diff --git a/console/templates/console-vnc-full.html b/console/templates/console-vnc-full.html
index aedeb2b5..8fb2e351 100755
--- a/console/templates/console-vnc-full.html
+++ b/console/templates/console-vnc-full.html
@@ -177,6 +177,9 @@
     }
 
     let fullPath = '{{ ws_path|escapejs }}';
+    if (fullPath.startsWith('/')) {
+        fullPath = fullPath.substring(1);
+    }
     const token = '{{ token|escapejs }}';
     if (token) {
         fullPath += (fullPath.includes('?') ? '&' : '?') + 'token=' + encodeURIComponent(token);
@@ -184,7 +187,7 @@
 
     const defaults = {
         autoconnect: true,
-        resize: {{ scale|yesno:"'scale','off'" }},
+        resize: '{% if resize_session %}remote{% elif scale %}scale{% else %}off{% endif %}',
         view_only: {{ view_only|yesno:"true,false" }},
         view_clip: {{ clip_viewport|yesno:"true,false" }},
         {% if perms.instances.passwordless_console and console_passwd %}
@@ -194,7 +197,7 @@
 
     const mandatory = {
         host: '{{ ws_host|escapejs }}',
-        port: {{ ws_port }},
+        port: {{ ws_port|default:6080 }},
         path: fullPath,
     };
 
diff --git a/console/tests.py b/console/tests.py
index 3d676461..4077c38e 100644
--- a/console/tests.py
+++ b/console/tests.py
@@ -284,7 +284,48 @@ class ConsoleViewsTestCase(TestCase):
         resp_full = self.client.get(url_full)
         self.assertEqual(resp_full.status_code, 200)
         content_full = resp_full.content.decode("utf-8")
-        self.assertIn(r"O\u0027Brian", content_full)
+        # In script tag, password must use JS unicode escape and not HTML entities
+        main_script_block = [
+            s.split("</script>")[0]
+            for s in content_full.split("<script")
+            if "defaults" in s
+        ][0]
+        self.assertIn(r"password: 'O\u0027Brian", main_script_block)
+        self.assertNotIn("&#39;", main_script_block)
+        self.assertNotIn("&#x27;", main_script_block)
+
+    @patch("console.views.wvmInstance")
+    def test_console_full_resize_syntax_validity(self, mock_wvm):
+        mock_conn = MagicMock()
+        mock_conn.get_console_type.return_value = "vnc"
+        mock_conn.get_console_websocket_port.return_value = None
+        mock_wvm.return_value = mock_conn
+
+        self.client.force_login(self.admin_user)
+
+        # Default: scale=False, resize_session=False -> 'off'
+        url = reverse("console") + f"?token={self.token}&view=full"
+        resp = self.client.get(url)
+        self.assertEqual(resp.status_code, 200)
+        content = resp.content.decode("utf-8")
+        self.assertIn("resize: 'off',", content)
+        self.assertNotIn("&#x27;off&#x27;", content)
+        self.assertNotIn("&#39;off&#39;", content)
+
+        # scale=True, resize_session=False -> 'scale'
+        url_scale = reverse("console") + f"?token={self.token}&view=full&scale=true"
+        resp_scale = self.client.get(url_scale)
+        self.assertEqual(resp_scale.status_code, 200)
+        content_scale = resp_scale.content.decode("utf-8")
+        self.assertIn("resize: 'scale',", content_scale)
+
+        # resize_session=True -> 'remote'
+        url_remote = reverse("console") + f"?token={self.token}&view=full&resize_session=true"
+        resp_remote = self.client.get(url_remote)
+        self.assertEqual(resp_remote.status_code, 200)
+        content_remote = resp_remote.content.decode("utf-8")
+        self.assertIn("resize: 'remote',", content_remote)
+
 
     @patch("console.views.wvmInstance")
     def test_console_libvirt_error_fallback(self, mock_wvm):