Form Authentication redirection

When a request is received that requires form authentication, the server remembers the original URL (and perhaps form encoded parameters) and redirects to a login page. Once the user completes the login form a request is sent to j_security_check, which if authentication is successful a redirection is sent to the saved URL.

However, since browsers have caches, iframes and javascript that issues ajax style requests, and since users can decline to authenticate on the first presentation of a web form, it is possible that for a given session multiple requests are received that are redirected to the login form. The problem for the server is to decide if it should eventually redirect to the first of the saved URLs; to the last of the saved; or to some heuristically chosen one in between.

Start by tracing the Servlet form-authentication flow from a protected request through the login form and j_security_check. Define and document how multiple saved URLs in one session should be selected after successful authentication, including requests from caches, iframes, AJAX, and declined login attempts.

Written by the indexing model from the issue text.