Logout keeps old URL as redirect URL in Firefox?

[nickvergessen]

@schiessle and me experience this problem in Firefox. Neither Chromium nor Safari suffers from this issue, but we have not idea what's causing it.

1. As an admin log in
2. Go to admin settings
3. Click log out
4. URL is now index.php/login?redirect_url=/index.php/settings/admin/overview
5. Log in as a normal user
6. 💥

Access forbidden
Logged in user must be an admin

Actually the mistake is in step 4. After the logout you should not have the redirect_url anymore. Happens in latest 14 + master, not sure when it started.

[nickvergessen]

The problem is:

server/core/Controller/LoginController.php

Line 134 in 85eb43b

$response->addHeader('Clear-Site-Data', '"cache", "storage", "executionContexts"');

If I remove this, the redirect works as intended. With this line the current page is reloaded, instead of the login page being loaded as requested by the redirect. This causes the middleware to throw NotLoggedIn error, redirecting to the login page with redirect parameter:

server/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php

Lines 246 to 250 in 8c1e75e

	if (isset($this->request->server['REQUEST_URI'])) {
	$params['redirect_url'] = $this->request->server['REQUEST_URI'];
	}
	$url = $this->urlGenerator->linkToRoute('core.login.showLoginForm', $params);
	$response = new RedirectResponse($url);

According to https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data that is exactly what should happen. But https://www.w3.org/TR/clear-site-data/#grammardef-executioncontexts says that is how it should be. Any idea what we could do @rullzer

[rullzer]

🙈 so the reason it works on chrome is that is doen't recognize executionContext

[nickvergessen]

Well, or they take location into account too

[rullzer]

Nope I get a console warnings:

Unrecognized type: "executionContexts".

[nickvergessen]

Okay, so remove it as a current workaround?

[rullzer]

So what I think would make sense:

1. Remove for now.

And as a fix we can do

1. In logout add a session variable
2. In login check this variable if set => clear variable and clear execution context

Does that sound sane?

[rullzer]

I'll try to implement that this evening to see if it works.

[nickvergessen]

Sounds good