Add redirect_back and deprecate redirect_to :back

[derekprior]

redirect_to :back is a somewhat common pattern in Rails apps, but it
is not completely safe. There are a number of circumstances where HTTP
referrer information is not available on the request. This happens often
with bot traffic and occasionally to user traffic depending on browser
security settings.

When there is no referrer available on the request, redirect_to :back
will raise ActionController::RedirectBackError, usually resulting in
an application error.

redirect_to_back_or_default is a helper I have added to many rails
applications to avoid this situation and now I'm proposing it be added
to Rails proper and encouraged in place of redirect_to :back.

[rails-bot]

r? @kaspth

(@rails-bot has picked a reviewer for you, use r? to override)

[simi]

I think it is common pattern to use rescue_from in those situations.

class ApplicationController < ActionController::Base
  rescue_from ActionController::RedirectBackError, with: :redirect_to_default

  protected
  def redirect_to_default
    redirect_to root_url
  end
end

[claudiob]

Hello and thanks for your contribution!

This happens often with bot traffic and occasionally to user traffic depending on browser
security settings.

You are making the point that redirects_to :back is not something you can rely on, and I agree with that.
For that reason, I have stopped using redirects_to :back altogether a while ago.

Could you provide a real case (with or without code) in which you would still need to redirect to the previous page if the referrer is present while, at the same time, redirect to a default page if not present?

That would be helpful to better understand the value of the PR. Thanks! 🎀

[derekprior]

Thanks for the great questions @claudiob.

For that reason, I have stopped using redirects_to :back altogether a while ago.

I largely concur, but as a consultant exposed to dozens of applications, I continue to see redirect_to :back in app after app. In some cases it's simple enough to refactor to a static redirect, but in other cases :back with a sensible default is really the simplest thing that could possibly (very nearly always 😁) work.

Consider, for example, an application that manages products. Products can be viewed in many different contexts and from each of these views you are able to "Activate" of "Deactivate" the product. The controller for activations may look like this:

class ProductActivationsController < ActionController::Base
  def create
    Product.find(params[:product_id]).activate
    redirect_to :back, notice: "Product activated"
  end

  def destroy
    Product.find(params[:product_id]).deactivate
    redirect_to :back, notice: "Product deactivated"
  end
end

Because these controller actions can be called from various locations -- say from the admin products index, the admin product show, the store ui if you are an admin, or any number of various other places, the notion of "from wherever you came" is valuable. You can attempt to pass the return path explicitly as a parameter of the create and destroy action but then to avoid unvalidated redirects. It's a decent amount of code for a case when :back works well in all but a handful of cases.

If I were designing this solution in a clean room, I'd deprecate redirect_to :back and either rely on a gem for a smarter replacement or replace it with redirect_back_or_default so you would never get an exception.

Either way, I continue to see application that have dozens of not so straight-forward to solve ActionController::RedirectBackErrors in their error trackers. The simplest fix is generally to provide a default rather than the shotgun surgery that would be required to get the correct redirect for all occurrences. I'm not generally thrilled with this as a solution, but from a cost/benefit standpoint it tends to make a lot of sense.

I think it is common pattern to use rescue_from in those situations.

This can get out of hand if you have different defaults per action. It also relies on exceptions for flow control, which I'd prefer not to do.

[derekprior]

All that said, I'd totally understand not accepting this PR, but then I'd suggest deprecating redirect_to :back.

[sgrif]

I definitely agree that this should replace redirect_to :back with this. Our general philosophy has been to avoid constructs which could allow bad user input to make the server 500 trivially. rescue_from is definitely not sufficient.

That said, I'm not huge on the method name, it feels a bit long and unweildly to me.

[derekprior]

I agree. If deprecating redirect_to :back is on the table then I'd suggest something like def redirect_back(default:, *args). But if the previous method isn't going to be deprecated then I think they are too near eachother.

[bogdan]

Agree on deprecation of redirect_to :back. To the reasons mentioned above, I can add that passing magic symbols to a method seems bad API to me. rescue ActionController::RedirectBackError is bad idea when default differs per action.

[sgrif]

I like redirect_back(default:, *args). I think deprecating redirect_to :back is a separate discussion (which I am in favor of), but we can use that method name regardless. My only other concern is that :default doesn't necessarily imply anything if I'm reading code and not familiar with this exact problem.

[simi]

What about redirect_back(fallback: *args) ❓

[sgrif]

:fallback doesn't give much more context than :default. Maybe redirect_back(url_if_unknown:), though that's a bit verbose (maybe this needs to be verbose?)

[simi]

I was about to avoid url or path as part of the argument name.

[derekprior]

It's not always a URL. You could pass anything that worked with redirect_to. I think fallback is the best suggestion I've heard so far:

def create
  product = Product.find(params[:product_id]
  product.activate
  redirect_back(fallback: product, notice: "Activated")
end

In the context of redirect_back I think fallback is pretty clear. We could also use fallback_redirect?

[sgrif]

I think that :fallback is only clear if you know how back works, and
understand that it may not be there. I don't think that we can assume that.

On Sun, Dec 6, 2015, 10:31 AM Derek Prior notifications@github.com wrote:

It's not always a URL. You could pass anything that worked with
redirect_to. I think fallback is the best suggestion I've heard so far:

def create
product = Product.find(params[:product_id]
product.activate
redirect_back(fallback: product, notice: "Activated")end

In the context of redirect_back I think fallback is pretty clear. We
could also use fallback_redirect?

—
Reply to this email directly or view it on GitHub
#22506 (comment).

[simi]

@sgrif yes it is clear only if you know how :back works, but that should be explained in the documentation.

I think introducing of redirect_back, deprecation of redirect_to :back and leaving note in deprecation message and ActionController::RedirectBackError message will be great start for this feature.

[kaspth]

r? @sgrif

[sgrif]

I think redirect_back(fallback:) is the way to go for now. @derekprior Can you update and rebase?

[derekprior]

@sgrif updated and rebased.

[simi]

No deprecation of redirect_to(:back) for now?

Anyway I think the documentation of redirect_to(:back) should mention potential dangers and link to this new method.

[sgrif]

Let's just go ahead and deprecate, too

[derekprior]

@sgrif Deprecation added.

[sgrif]

These should all be assert_deprecated

[simi]

thanks all 🎊

[emilebosch]

Sorry im a bit sad about this. :( I like rails and i like that it optimized for happiness but this doesnt make me happy.

I'm ok with raises redirect errors, they are super loggable and rescuable. And then i know where this referer less stuff comes from.(ips, agents etcetc) But now i have to update all my code & rails engines etc etc. Am i missing something or does this really just do nothing except add work?

Why didn't you just made a comprise:

redirect_to :back, notice:"Yolo", fallback: '/'

And add a rails config that raises if fallback isn't present? But people that know what they are doing can just use whatever they want and put that config.raise_on_no_fallback = false

[juanantoniodamianv]

Hi!
Can I check the value of :back, so that if it is a specific url, I will go back, and if not, go back to root?