diff --git a/src/Surfnet/StepupSelfService/SelfServiceBundle/Controller/LocaleController.php b/src/Surfnet/StepupSelfService/SelfServiceBundle/Controller/LocaleController.php index ca4784927..a3c588175 100644 --- a/src/Surfnet/StepupSelfService/SelfServiceBundle/Controller/LocaleController.php +++ b/src/Surfnet/StepupSelfService/SelfServiceBundle/Controller/LocaleController.php @@ -30,7 +30,9 @@ public function switchLocaleAction(Request $request) { $returnUrl = $request->query->get('return-url'); - $domain = $request->getSchemeAndHttpHost(); + // Return URLs generated by us always include a path (ie. at least a forward slash) + // @see https://github.com/symfony/symfony/blob/master/src/Symfony/Component/HttpFoundation/Request.php#L878 + $domain = $request->getSchemeAndHttpHost() . '/'; if (strpos($returnUrl, $domain) !== 0) { $this->get('logger')->error(sprintf( 'Identity "%s" used illegal return-url for redirection after changing locale, aborting request',