Legacy UI redirect changes the requested KV secret version
- Dominant language
- Go
- Stars
- 36.3k
- Forks
- 4.8k
- PR merge metrics
- PR metrics pending
Description
**Describe the bug**
Legacy Vault UI deep links using `/ui/vault/secrets/...` do not preserve the requested KV secret version when they are redirected to the new `/ui/vault/secrets-engines/...` route.
For example, a saved link that explicitly requests version 1:
`https://vault/ui/vault/secrets/engine/kv/secret/details?version=1`
is redirected to:
`https://vault/ui/vault/secrets-engines/engine/kv/secret/details?version=2`
The path migration is expected, but changing `version=1` to `version=2` is not. The equivalent URL that already uses the new route works correctly and displays version 1:
`https://vault/ui/vault/secrets-engines/engine/kv/secret/details?version=1`
This breaks durable links to historical secret versions stored in documentation, runbooks, tickets, and bookmarks. It can also cause users to view a different secret version than the one referenced by the original link.
**To Reproduce**
Steps to reproduce the behavior:
1. Use a KV v2 secret for which at least versions 1 and 2 exist.
2. Open a legacy UI deep link that explicitly requests version 1, replacing the host, mount, and secret path as needed: `https://vault/ui/vault/secrets/engine/kv/secret/details?version=1`.
3. Allow Vault UI to redirect the legacy `/secrets/` route to `/secrets-engines/`.
4. Observe that the resulting URL requests `version=2` instead of `version=1`.
5. Open `https://vault/ui/vault/secrets-engines/engine/kv/secret/details?version=1` directly and observe that version 1 is displayed correctly.
**Expected behavior**
The legacy route should redirect to the equivalent new route while preserving the complete query string, including the requested KV version. In this example:
`/ui/vault/secrets/engine/kv/secret/details?version=1`
should redirect to:
`/ui/vault/secrets-engines/engine/kv/secret/details?version=1`
Existing documentation links and bookmarks should continue to reference the same secret version after the route migration.
**Environment:**
* Vault Server Version (retrieve with `vault status`): Not provided
* Vault CLI Version (retrieve with `vault version`): Not applicable to this UI redirect
* Server Operating System/Architecture: Not provided
Vault server configuration file(s):
```hcl
# No configuration known to be relevant; the behavior occurs in the Vault UI route redirect.
```
**Additional context**
This appears related to the migration of Vault UI routes from `/secrets` to `/secrets-engines`. A previously reported deep-link redirect problem was addressed in #31939, but the redirect also needs to preserve query parameters and their values. Please add regression coverage for legacy KV deep links with `?version=` so the redirect cannot silently select the latest or another secret version.
Contributor guide
Research direction
Start by tracing the legacy `/ui/vault/secrets/` redirect to the `/ui/vault/secrets-engines/` route, with issue #31939 as related context, and inspect how the query string is handled. Confirm that a legacy KV deep link preserves `?version=` and add regression coverage showing the redirected URL still requests the specified version.
Written by the indexing model from the issue text.
Assessment
- Domain
- frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100