It is not possible to use referer as redirection location using SavedRequestAwareAuthenticationSuccessHandler

Summary

Current implementation by any means does not allow to use referer as redirection url despite extending AbstractAuthenticationTargetUrlRequestHandler which allows that and exposes propert setter useReferer(true).

Actual Behavior

Exposed useReferer setter has no effect.

Expected Behavior

Use referrer as redirection location if useReferer(true) is set and proper header is present in the original request.

Version

<spring-security.version>5.0.10.RELEASE</spring-security.version>

Sample

This example shows badly written (trial and error yet) workaround implementation

Will add working workaround

This is done to affect following check inside SavedRequestAwareAuthenticationSuccessHandler

https://github.com/spring-projects/spring-security/blob/05caf3d8fbdba89f42de621c04dce454317431e8/web/src/main/java/org/springframework/security/web/authentication/SavedRequestAwareAuthenticationSuccessHandler.java#L84-L91

In general, if isAlwaysUseDefaultTargetUrl - default target will be used even if not specified. If targetUrl parameter is set and present - it will be used. There is no other path to access .superOnAuthenticationSuccess to get referer working having saver request - and this is my goal

Start with web/src/main/java/org/springframework/security/web/authentication/SavedRequestAwareAuthenticationSuccessHandler.java, especially the linked lines 84-91, and compare its behavior with AbstractAuthenticationTargetUrlRequestHandler. Reproduce the saved-request flow using the issue's referer header and useReferer(true) conditions; done means the original referer is used as the redirect location when no higher-priority target applies.