Rails 7: allow redirections to other/external hosts after logout.

[ammancilla]

Context

When using different authentication strategies, devise_saml_autheticatable in my case, it's common to redirect the user to an external host after logout.

Rails 7 requires to explicitly pass allow_other_host: true to redirect_to to allow such redirections. Otherwise, an ugly exception is raised.

• Devise 4.8.1
• Rails 7.0.1

Expected behaviour.

When using devise with Rails 7 and setting the after_sign_out_path_for to an external host, the user is sucessfully redirected.

Current behaviour.

When using devise with Rails 7 and setting the after_sign_out_path_for to an external host, a ActionController::Redirecting::UnsafeRedirectError is raised.

[ammancilla]

I am not sure about what's the best place to write tests for this. If someone can point me in a direction I'll be happy to add tests 😃.

[ammancilla]

After thinking about the proposed solution a bit longer, I wonder if it actually is the best one 😅.

Different use cases might require different options to be passed to the redirect_to. It's probably not possible to cover all such cases by hard coding options here. So, the question that comes to my mind now is: What's the best way to override the options passed to the redirect_to? For example, to also change the redirection status code etc.

• Override the destroy action in the controller. Then, having full control over the redirection (already possible).

• Provide a after_sign_out_redirect_options_for method or similar where users can define the custom options for the redirection?

• Other...

[allanclloyds]

Or set the default in Devise in the meantime to allow_other_host: true and put a warning in a comment in after_sign_up_path_for about overriding it with a user provided URLs? You have to go out of your way to override the method, so it doesn't seem like a less secure default.

[daslicious]

There are other places than logout that redirect_to would need allow_other_host: true.

For instance, if I'm on me.site.com and load site.com/sign_in, I'll get redirected back to me.site.com which would raise the exception here...
https://github.com/heartcombo/devise/blob/v4.8.1/app/controllers/devise_controller.rb#L116

I don't know how many instances like this there are

[kreintjes]

There are other places than logout that redirect_to would need allow_other_host: true.

Yes indeed. For instance we need to be able to set it for the registrations_controller: https://github.com/heartcombo/devise/blob/v4.8.1/app/controllers/devise/registrations_controller.rb#L25-L29

[nehagupta93]

Any chance this will be looked into soon? The same issue happens if after_sign_in_path_for is overridden to return an external host.
For now I'm making do by overriding Devise::SessionsController#create.

[trueinviso]

I'm also having this issue because I want to redirect to an external Stripe checkout page after a user signs up. For now I am overriding the respond_with method:

def respond_with(resource, location: nil)
  if !resource.persisted? || resource.active_for_authentication?
    super
  else
    co_session = Stripe::Checkout::Session.create(...)
    redirect_to co_session.url, allow_other_host: true
  end
end

[seanarnold]

Seems like the best way to approach this is add a alow_directs_to_other_hosts configuration under Devise.configure, and then use that everywhere redirect_to is currently used.

Should be relatively straightforward I think

[richardonrails]

+1 on improvements here, my login broke after a Rails 7 upgrade because I am routing users to a per-user custom external URLs in after_sign_in_path_for

[sealabcore]

+1 to improvements here, for now we will have to set this new config to false to have our app to still work with devise.

[fonji]

+1 Haven't found another way than setting action_controller.raise_on_open_redirects = false, more than a year later

[fashberg]

fa

[ivan-kocienski-gfsc]

I just ran in to this problem in project and fixed it across the entirety of devise with

class DeviseController
  # monkey patching devise so it can handle the new default behaviour in rails 7
  #   redirects

  original_redirect_to = instance_method(:redirect_to)
  define_method(:redirect_to) do |options, response_options = {}|
    if options.is_a?(Hash)
      options[:allow_other_host] = true unless options.key?(:allow_other_host)

    elsif response_options.is_a?(Hash)
      response_options[:allow_other_host] = true unless response_options.key?(:allow_other_host)
    end

    original_redirect_to
      .bind_call(self, options, response_options)
  end
end

But please can this be fixed properly?