spring-projects / spring-projects/spring-security
SEC-3186: Clear SavedRequest when user accesses unsecured page
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Lukas Makor (Migrated from SEC-3186) said:
When a user tries to access a page which is only allowed for authorized users, the user is redirected to the login page and the original request is saved in the HttpRequestCache.
However when the user then accesses a public page the saved request is not cleared and therefore when the user now navigates directly to the login page and logs himself in, he is redirected to the authorized page he tried to access in the beginning.
But shouldn't the user be redirected to the defaultsuccessurl in this case, because he didn't try to access the authorized page right before the login?
UPDATE:
If you need any additional infos or exapmles, please let me know!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how HttpRequestCache is handled when a user leaves an authorized request for an unsecured page, then follow the login success and defaultsuccessurl flow. Reproduce the described navigation sequence and verify that the saved request is cleared so a direct login uses the default success URL.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100