SEC-1127: SwitchUserProcessingFilter should pass along AuthenticationException when redirecting to failureUrl #1378

Closed
spring-issuemaster opened this Issue Mar 20, 2009 · 2 comments

Comments

Projects
None yet
1 participant

Jared Stehler(Migrated from SEC-1127) said:

The SwitchUserProcessingFilter currently provides only two options for error handling: redirection to a failure url, or output of a single line of text (‘Switch User Failed: message’). It would be nice if the redirect stored the AuthenticationException somewhere in a request attribute / parameter, so that the failure screen could contain more detailed output (i.e. if the failure was related to the account being locked vs disabled, etc).

Example patch:

```
private void redirectToFailureUrl(HttpServletRequest request, HttpServletResponse response,
AuthenticationException failed) throws IOException {
logger.debug(“Switch User failed”, failed);

if (switchFailureUrl != null) {

```
- request.setAttribute( “authenticationException”, failed );
sendRedirect(request, response, switchFailureUrl);
} else {
response.getWriter().print("Switch user failed: " + failed.getMessage());
response.flushBuffer();
}
}

\ Note: I am note sure if request attributes will transfer through a redirect; we could pass the failure message as a GET parameter perhaps?

Luke Taylor said:

switch user error handling has already been addressed as part of SEC-745 (see also SEC-959), so you should be able to customize the behaviour to accomodate any requirement by injecting a suitable strategy.

Luke Taylor said:

No further input, so closing.

spring-issuemaster added this to the 3.0.0 M1 milestone Feb 5, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment