Always redirect ajax requests when session expired

core-bundle/src/Resources/public/mootao.js

@@ -45,6 +45,8 @@ Request.Contao = new Class(
 		var url = this.getHeader('X-Ajax-Location'),
 			json;
 
+		this.redirectIfUnauthorized();
+
 		if (url && this.options.followRedirects) {
 			location.replace(url);
 			return;
@@ -80,12 +82,23 @@ Request.Contao = new Class(
 	failure: function() {
 		var url = this.getHeader('X-Ajax-Location');
 
+		this.redirectIfUnauthorized();
+
 		if (url && this.options.followRedirects && this.status >= 300 && this.status < 400) {
 			location.replace(url);
 			return;
 		}
 
 		this.onFailure();
+	},
+
+	redirectIfUnauthorized: function() {
+		var url = this.getHeader('X-Ajax-Location'),
+			unauthorized = null !== this.getHeader('X-Is-Unauthorized');
+
+		if (url && unauthorized) {
+			location.replace(url);
+		}
 	}
 });
 

core-bundle/src/Security/Authentication/AuthenticationEntryPoint.php

@@ -15,6 +15,7 @@
 use Contao\CoreBundle\Routing\ScopeMatcher;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Exception\UnauthorizedHttpException;
 use Symfony\Component\HttpKernel\UriSigner;
 use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
@@ -47,14 +48,20 @@ public function start(Request $request, AuthenticationException $authException =
         throw new UnauthorizedHttpException('', 'Not authorized');
     }
 
-    private function redirectToBackend(Request $request): RedirectResponse
+    private function redirectToBackend(Request $request): Response
     {
         $url = $this->router->generate(
             'contao_backend_login',
             ['redirect' => $request->getUri()],
             UrlGeneratorInterface::ABSOLUTE_URL
         );
 
-        return new RedirectResponse($this->uriSigner->sign($url));
+        $location = $this->uriSigner->sign($url);
+
+        if ($request->isXmlHttpRequest()) {
+            return new Response($location, 303, ['X-Is-Unauthorized' => 'true', 'X-Ajax-Location' => $location]);
+        }
+
+        return new RedirectResponse($location, 302);
     }
 }

core-bundle/tests/Security/Authentication/AuthenticationEntryPointTest.php

@@ -17,6 +17,7 @@
 use Contao\CoreBundle\Tests\TestCase;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Exception\UnauthorizedHttpException;
 use Symfony\Component\HttpKernel\UriSigner;
 use Symfony\Component\Routing\RouterInterface;
@@ -77,6 +78,41 @@ public function testSignsTheBackendRedirectUrl(): void
         $this->assertSame('http://localhost/contao/login?_hash=%2FxSCw6cwMlws5DEhBCvs0%2F75oQA8q%2FgMkZEnYCf6QSE%3D&redirect=https%3A%2F%2Fcontao.org%2Fpreview.php%2Fabout-contao.html', $response->getTargetUrl());
     }
 
+    public function testRedirectsAjaxRequests(): void
+    {
+        $request = Request::create('http://localhost/contao/login?redirect=https%3A%2F%2Fcontao.org%2Fpreview.php%2Fabout-contao.html');
+        $request->headers->set('X-Requested-With', 'XMLHttpRequest');
+
+        $router = $this->createMock(RouterInterface::class);
+        $router
+            ->expects($this->once())
+            ->method('generate')
+            ->with('contao_backend_login', ['redirect' => $request->getUri()])
+            ->willReturn('http://localhost/contao/login?redirect=https%3A%2F%2Fcontao.org%2Fpreview.php%2Fabout-contao.html')
+        ;
+
+        $scopeMatcher = $this->createMock(ScopeMatcher::class);
+        $scopeMatcher
+            ->expects($this->once())
+            ->method('isBackendRequest')
+            ->with($request)
+            ->willReturn(true)
+        ;
+
+        $entryPoint = new AuthenticationEntryPoint(
+            $router,
+            new UriSigner('secret'),
+            $scopeMatcher
+        );
+
+        $response = $entryPoint->start($request);
+
+        $this->assertInstanceOf(Response::class, $response);
+        $this->assertFalse($response->headers->has('Location'));
+        $this->assertTrue($response->headers->has('X-Is-Unauthorized'));
+        $this->assertSame('http://localhost/contao/login?_hash=%2FxSCw6cwMlws5DEhBCvs0%2F75oQA8q%2FgMkZEnYCf6QSE%3D&redirect=https%3A%2F%2Fcontao.org%2Fpreview.php%2Fabout-contao.html', $response->headers->get('X-Ajax-Location'));
+    }
+
     public function testAddsARefererToTheBackendRedirectUrlIfTheQueryIsEmpty(): void
     {
         $request = Request::create('/');