[JENKINS-64991] Login redirect to previous page no longer works

When logging in, the "from" URL is no longer being redirected to.

docker run -p 8080:8080 -p 50000:50000 jenkins/jenkins:2.265
Pass the setup wizard not installing anything, keep admin user.
In /configureSecurity, allow anonymous read access
As anonymous, go to http://localhost:8080/view/all/builds
Click log in
Log in as admin

Expected result (up to 2.265): Back to Build History

Actual result (from 2.266): Index page

This is a regression, probably caused by

jenkins/core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java

Lines 61 to 96 in 9cf3f73

    
               /* TODO none of this compiles against Spring Security; rewrite (try InteractiveAuthenticationSuccessEvent & SimpleUrlAuthenticationFailureHandler): 
        
               @Override 
        
               protected String determineTargetUrl(HttpServletRequest request) { 
        
                   AbstractAuthenticationProcessingFilter f = new UsernamePasswordAuthenticationFilter(); 
        
                   String targetUrl = request.getParameter("from"); 
        
                   request.getSession().setAttribute("from", targetUrl); 
        
                   if (targetUrl == null) 
        
                       return getDefaultTargetUrl(); 
        
                   if (!Util.isSafeToRedirectTo(targetUrl)) 
        
                       return "."; // avoid open redirect 
        
                   // URL returned from determineTargetUrl() is resolved against the context path, 
        
                   // whereas the "from" URL is resolved against the top of the website, so adjust this. 
        
                   if(targetUrl.startsWith(request.getContextPath())) 
        
                       return targetUrl.substring(request.getContextPath().length()); 
        
                   // not sure when this happens, but apparently this happens in some case. 
        
                   // see #1274 
        
                   return targetUrl; 
        
               } 
        
               /** 
        
                * @see AbstractProcessingFilter#determineFailureUrl(HttpServletRequest, AuthenticationException) 
        
                * / 
        
               @Override 
        
               protected String determineFailureUrl(HttpServletRequest request, AuthenticationException failed) { 
        
                   Properties excMap = getExceptionMappings(); 
        
           		String failedClassName = failed.getClass().getName(); 
        
           		String whereFrom = request.getParameter("from"); 
        
           		request.getSession().setAttribute("from", whereFrom); 
        
           		return excMap.getProperty(failedClassName, getAuthenticationFailureUrl()); 
        
               } 
        
               */

Originally reported by danielbeck, imported from: Login redirect to previous page no longer works

assignee: danielbeck
status: Closed
priority: Minor
component(s): core
label(s): 2.289.2-fixed, JEP-227, ci.jenkins.io-ux, regression, ux
resolution: Fixed
resolved: 2021-05-25T20:34:41+00:00
votes: 1
watchers: 7
imported: 2025-11-24

Raw content of original issue

When logging in, the "from" URL is no longer being redirected to.

	docker run -p 8080:8080 -p 50000:50000 jenkins/jenkins:2.265
	Pass the setup wizard not installing anything, keep admin user.
	In /configureSecurity, allow anonymous read access
	As anonymous, go to http://localhost:8080/view/all/builds
	Click log in
	Log in as admin



Expected result (up to 2.265): Back to Build History

Actual result (from 2.266): Index page

This is a regression, probably caused by 

  
    
      jenkins/core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java
    
    
        Lines 61 to 96
      in
      9cf3f73
    
  
  
    

        
          
               /* TODO none of this compiles against Spring Security; rewrite (try InteractiveAuthenticationSuccessEvent & SimpleUrlAuthenticationFailureHandler): 
        

        
          
            
        

        
          
               @Override 
        

        
          
               protected String determineTargetUrl(HttpServletRequest request) { 
        

        
          
                   AbstractAuthenticationProcessingFilter f = new UsernamePasswordAuthenticationFilter(); 
        

        
          
                   String targetUrl = request.getParameter("from"); 
        

        
          
                   request.getSession().setAttribute("from", targetUrl); 
        

        
          
            
        

        
          
                   if (targetUrl == null) 
        

        
          
                       return getDefaultTargetUrl(); 
        

        
          
            
        

        
          
                   if (!Util.isSafeToRedirectTo(targetUrl)) 
        

        
          
                       return "."; // avoid open redirect 
        

        
          
            
        

        
          
                   // URL returned from determineTargetUrl() is resolved against the context path, 
        

        
          
                   // whereas the "from" URL is resolved against the top of the website, so adjust this. 
        

        
          
                   if(targetUrl.startsWith(request.getContextPath())) 
        

        
          
                       return targetUrl.substring(request.getContextPath().length()); 
        

        
          
            
        

        
          
                   // not sure when this happens, but apparently this happens in some case. 
        

        
          
                   // see #1274 
        

        
          
                   return targetUrl; 
        

        
          
               } 
        

        
          
            
        

        
          
               /** 
        

        
          
                * @see AbstractProcessingFilter#determineFailureUrl(HttpServletRequest, AuthenticationException) 
        

        
          
                * / 
        

        
          
               @Override 
        

        
          
               protected String determineFailureUrl(HttpServletRequest request, AuthenticationException failed) { 
        

        
          
                   Properties excMap = getExceptionMappings(); 
        

        
          
           		String failedClassName = failed.getClass().getName(); 
        

        
          
           		String whereFrom = request.getParameter("from"); 
        

        
          
           		request.getSession().setAttribute("from", whereFrom); 
        

        
          
           		return excMap.getProperty(failedClassName, getAuthenticationFailureUrl()); 
        

        
          
               } 
        

        
          
               */

Remote link associated with this issue:
- jenkinsci/jenkins#5461

jglick:

Original comment link

Raw content of original comment:

Thought I had checked this scenario, but evidently not. As you can see, test coverage in this area was pretty weak.

danielbeck:

Original comment link

Raw content of original comment:

jglick I think there's a difference between this as described, and the redirect from an Unauthorized response. I think the latter still works.

jglick:

Original comment link

Raw content of original comment:

I see, this is about a page on which you had a 200 status but decided to log in anyway.

danielbeck:

Original comment link

Raw content of original comment:

Yes, step 3 in the reproduction is important. Without it (and consequently without step 5, you just get redirected to the login form), the redirect still works in 2.266.

danielbeck:

Original comment link

Raw content of original comment:

ci.jenkins.io was updated to 2.277.1 and it's incredibly annoying. I'm not triggering PR builds through that UI anymore.

Click on a PR status
Go to the build info
Click Blue Ocean login link
Log in
Get forwarded to home page

ci.jenkins.io was updated to 2.277.1 and it's incredibly annoying. I'm not triggering PR builds through that UI anymore.

Click on a PR status
Go to the build info
Click Blue Ocean login link
Log in
Get forwarded to home page

timja:

Original comment link

Raw content of original comment:

clicking re-run from the checks page is probably quicker than that anyway

danielbeck:

Original comment link

Raw content of original comment:

clicking re-run from the checks page is probably quicker than that anyway

Not possible in jenkins-infra/update-center2

clicking re-run from the checks page is probably quicker than that anyway

Not possible in jenkins-infra/update-center2

basil:

Original comment link

Raw content of original comment:

One of my users reported this issue after we upgraded from 2.263.4 to 2.277.3.

danielbeck:

Original comment link

Raw content of original comment:

[JENKINS-64991] Redirect to previous page after login #5461 as a start, unsure whether I'll find the time to finish in the next few weeks though.

#5461 as a start, unsure whether I'll find the time to finish in the next few weeks though.

nkadelgarcia:

Original comment link

Raw content of original comment:

It's particularly irksome if you allow anonymous browsing to review the status of your jobs, and need to log in to do a build or update an option.

timja:

Original comment link

Raw content of original comment:

The fix is merged and will be released next week

[Original relates_to from Jira: JENKINS-66026]

[Original relates_to from Jira: JENKINS-65452]

Navigation Menu

Repository navigation

[JENKINS-64991] Login redirect to previous page no longer works #11939

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	/* TODO none of this compiles against Spring Security; rewrite (try InteractiveAuthenticationSuccessEvent & SimpleUrlAuthenticationFailureHandler):

	@Override
	protected String determineTargetUrl(HttpServletRequest request) {
	AbstractAuthenticationProcessingFilter f = new UsernamePasswordAuthenticationFilter();
	String targetUrl = request.getParameter("from");
	request.getSession().setAttribute("from", targetUrl);

	if (targetUrl == null)
	return getDefaultTargetUrl();

	if (!Util.isSafeToRedirectTo(targetUrl))
	return "."; // avoid open redirect

	// URL returned from determineTargetUrl() is resolved against the context path,
	// whereas the "from" URL is resolved against the top of the website, so adjust this.
	if(targetUrl.startsWith(request.getContextPath()))
	return targetUrl.substring(request.getContextPath().length());

	// not sure when this happens, but apparently this happens in some case.
	// see #1274
	return targetUrl;
	}

	/**
	* @see AbstractProcessingFilter#determineFailureUrl(HttpServletRequest, AuthenticationException)
	* /
	@Override
	protected String determineFailureUrl(HttpServletRequest request, AuthenticationException failed) {
	Properties excMap = getExceptionMappings();
	String failedClassName = failed.getClass().getName();
	String whereFrom = request.getParameter("from");
	request.getSession().setAttribute("from", whereFrom);
	return excMap.getProperty(failedClassName, getAuthenticationFailureUrl());
	}
	*/

[JENKINS-64991] Login redirect to previous page no longer works #11939

Description

Activity

jenkins-infra-bot commented on Mar 2, 2021

jenkins-infra-bot commented on Mar 2, 2021

jenkins-infra-bot commented on Mar 2, 2021

jenkins-infra-bot commented on Mar 2, 2021

jenkins-infra-bot commented on Mar 2, 2021

jenkins-infra-bot commented on Mar 11, 2021

jenkins-infra-bot commented on Mar 11, 2021

jenkins-infra-bot commented on Mar 14, 2021

jenkins-infra-bot commented on May 4, 2021

jenkins-infra-bot commented on May 5, 2021

jenkins-infra-bot commented on May 27, 2021

jenkins-infra-bot commented on May 27, 2021

jenkins-infra-bot commented on Nov 24, 2025

jenkins-infra-bot commented on Nov 24, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions