Skip to content

Commit

Permalink
Cleanup of relative redirect handling #11014
Browse files Browse the repository at this point in the history 
+ Handle request relative redirects
+ Moved to Response
+ Changed default to allow relative
  • Loading branch information
@gregw
gregw committed Dec 4, 2023
1 parent 087191d commit 9dea2e0
Show file tree
Hide file tree
Showing 2 changed files with 18 additions and 16 deletions.
4 changes: 3 additions & 1 deletion ...y-security/src/main/java/org/eclipse/jetty/security/authentication/FormAuthenticator.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -277,7 +277,9 @@ public AuthenticationState validateRequest(Request request, Response response, C
// Redirect to original request
Session session = request.getSession(false);
HttpURI savedURI = (HttpURI)session.getAttribute(__J_URI);
String originalURI = savedURI != null ? savedURI.asString() : Request.getContextPath(request);
String originalURI = savedURI != null
? savedURI.getPathQuery()
: Request.getContextPath(request);
if (originalURI == null)
originalURI = "/";
UserAuthenticationSent formAuth = new UserAuthenticationSent(getAuthenticationType(), user);
Expand Down
30 changes: 15 additions & 15 deletions ...y-core/jetty-security/src/test/java/org/eclipse/jetty/security/FormAuthenticatorTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -129,17 +129,17 @@ public void testLoginRedirect() throws Exception

response = _connector.getResponse("GET /ctx/any/user HTTP/1.0\r\nHost:host:8888\r\n\r\n");
assertThat(response, containsString("HTTP/1.1 302 Found"));
assertThat(response, containsString("Location: http://host:8888/ctx/login"));
assertThat(response, containsString("Location: /ctx/login"));
assertThat(response, containsString("Set-Cookie: JSESSIONID="));

response = _connector.getResponse("GET /ctx/known/user HTTP/1.0\r\nHost:host:8888\r\n\r\n");
assertThat(response, containsString("HTTP/1.1 302 Found"));
assertThat(response, containsString("Location: http://host:8888/ctx/login"));
assertThat(response, containsString("Location: /ctx/login"));
assertThat(response, containsString("Set-Cookie: JSESSIONID="));

response = _connector.getResponse("GET /ctx/admin/user HTTP/1.0\r\nHost:host:8888\r\n\r\n");
assertThat(response, containsString("HTTP/1.1 302 Found"));
assertThat(response, containsString("Location: http://host:8888/ctx/login"));
assertThat(response, containsString("Location: /ctx/login"));
assertThat(response, containsString("Set-Cookie: JSESSIONID="));
}

Expand Down Expand Up @@ -167,7 +167,7 @@ public void testUseExistingSession() throws Exception

response = _connector.getResponse("GET /ctx/any/user HTTP/1.0\r\nHost:host:8888\r\nCookie: JSESSIONID=" + sessionId + "\r\n\r\n");
assertThat(response, containsString("HTTP/1.1 302 Found"));
assertThat(response, containsString("Location: http://host:8888/ctx/login"));
assertThat(response, containsString("Location: /ctx/login"));
assertThat(response, not(containsString("Set-Cookie: JSESSIONID=")));
}

Expand All @@ -182,13 +182,13 @@ public void testError() throws Exception
String sessionId = "unknown";
response = _connector.getResponse("GET /ctx/any/user HTTP/1.0\r\nHost:host:8888\r\nCookie: JSESSIONID=" + sessionId + "\r\n\r\n");
assertThat(response, containsString("HTTP/1.1 302 Found"));
assertThat(response, containsString("Location: http://host:8888/ctx/login"));
assertThat(response, containsString("Location: /ctx/login"));
assertThat(response, containsString("Set-Cookie: JSESSIONID="));
sessionId = sessionId(response);

response = _connector.getResponse("GET /ctx/j_security_check?j_username=user&j_password=wrong HTTP/1.0\r\nHost:host:8888\r\nCookie: JSESSIONID=" + sessionId + "\r\n\r\n");
assertThat(response, containsString("HTTP/1.1 302 Found"));
assertThat(response, containsString("Location: http://host:8888/ctx/error"));
assertThat(response, containsString("Location: /ctx/error"));
assertThat(response, not(containsString("Set-Cookie: JSESSIONID=")));

response = _connector.getResponse("""
Expand All @@ -201,7 +201,7 @@ public void testError() throws Exception
j_username=user&j_password=wrong
""");
assertThat(response, containsString("HTTP/1.1 302 Found"));
assertThat(response, containsString("Location: http://host:8888/ctx/error"));
assertThat(response, containsString("Location: /ctx/error"));
assertThat(response, not(containsString("Set-Cookie: JSESSIONID=")));
}

Expand All @@ -216,13 +216,13 @@ public void testLoginQuery() throws Exception
String sessionId = "unknown";
response = _connector.getResponse("GET /ctx/any/user HTTP/1.0\r\nHost:host:8888\r\nCookie: JSESSIONID=" + sessionId + "\r\n\r\n");
assertThat(response, containsString("HTTP/1.1 302 Found"));
assertThat(response, containsString("Location: http://host:8888/ctx/login"));
assertThat(response, containsString("Location: /ctx/login"));
assertThat(response, containsString("Set-Cookie: JSESSIONID="));
sessionId = sessionId(response);

response = _connector.getResponse("GET /ctx/j_security_check?j_username=user&j_password=password HTTP/1.0\r\nHost:host:8888\r\nCookie: JSESSIONID=" + sessionId + "\r\n\r\n");
assertThat(response, containsString("HTTP/1.1 302 Found"));
assertThat(response, containsString("Location: http://host:8888/ctx/any/user"));
assertThat(response, containsString("Location: /ctx/any/user"));
assertThat(response, containsString("Set-Cookie: JSESSIONID="));
String unsafeSessionId = sessionId;
sessionId = sessionId(response);
Expand All @@ -240,7 +240,7 @@ public void testLoginQuery() throws Exception

response = _connector.getResponse("GET /ctx/any/user HTTP/1.0\r\nHost:host:8888\r\nCookie: JSESSIONID=" + unsafeSessionId + "\r\n\r\n");
assertThat(response, containsString("HTTP/1.1 302 Found"));
assertThat(response, containsString("Location: http://host:8888/ctx/login"));
assertThat(response, containsString("Location: /ctx/login"));
assertThat(response, containsString("Set-Cookie: JSESSIONID="));
}

Expand All @@ -255,7 +255,7 @@ public void testLoginForm() throws Exception
String sessionId = "unknown";
response = _connector.getResponse("GET /ctx/any/user HTTP/1.0\r\nHost:host:8888\r\nCookie: JSESSIONID=" + sessionId + "\r\n\r\n");
assertThat(response, containsString("HTTP/1.1 302 Found"));
assertThat(response, containsString("Location: http://host:8888/ctx/login"));
assertThat(response, containsString("Location: /ctx/login"));
assertThat(response, containsString("Set-Cookie: JSESSIONID="));
sessionId = sessionId(response);

Expand All @@ -269,7 +269,7 @@ public void testLoginForm() throws Exception
j_username=user&j_password=password
""".formatted(sessionId));
assertThat(response, containsString("HTTP/1.1 302 Found"));
assertThat(response, containsString("Location: http://host:8888/ctx/any/user"));
assertThat(response, containsString("Location: /ctx/any/user"));
assertThat(response, containsString("Set-Cookie: JSESSIONID="));
String unsafeSessionId = sessionId;
sessionId = sessionId(response);
Expand All @@ -287,7 +287,7 @@ public void testLoginForm() throws Exception

response = _connector.getResponse("GET /ctx/any/user HTTP/1.0\r\nHost:host:8888\r\nCookie: JSESSIONID=" + unsafeSessionId + "\r\n\r\n");
assertThat(response, containsString("HTTP/1.1 302 Found"));
assertThat(response, containsString("Location: http://host:8888/ctx/login"));
assertThat(response, containsString("Location: /ctx/login"));
assertThat(response, containsString("Set-Cookie: JSESSIONID="));
}

Expand All @@ -311,13 +311,13 @@ public void testRedirectToPost() throws Exception
name1=value1&name2=value2\r
""".formatted(sessionId));
assertThat(response, containsString("HTTP/1.1 303 See Other"));
assertThat(response, containsString("Location: http://host:8888/ctx/login"));
assertThat(response, containsString("Location: /ctx/login"));
assertThat(response, containsString("Set-Cookie: JSESSIONID="));
sessionId = sessionId(response);

response = _connector.getResponse("GET /ctx/j_security_check?j_username=user&j_password=password HTTP/1.0\r\nHost:host:8888\r\nCookie: JSESSIONID=" + sessionId + "\r\n\r\n");
assertThat(response, containsString("HTTP/1.1 302 Found"));
assertThat(response, containsString("Location: http://host:8888/ctx/any/user?action=form"));
assertThat(response, containsString("Location: /ctx/any/user?action=form"));
assertThat(response, containsString("Set-Cookie: JSESSIONID="));
String unsafeSessionId = sessionId;
sessionId = sessionId(response);
Expand Down

0 comments on commit 9dea2e0

Please sign in to comment.