SEC-1127: SwitchUserProcessingFilter should pass along AuthenticationException when redirecting to failureUrl #1378

Closed
spring-issuemaster opened this Issue Mar 20, 2009 · 2 comments

1 participant

@spring-issuemaster

Jared Stehler (Migrated from SEC-1127) said:

The SwitchUserProcessingFilter currently provides only two options for error handling: redirection to a failure url, or output of a single line of text (‘Switch User Failed: message’). It would be nice if the redirect stored the AuthenticationException somewhere in a request attribute / parameter, so that the failure screen could contain more detailed output (i.e. if the failure was related to the account being locked vs disabled, etc).

Example patch:

private void redirectToFailureUrl(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) throws IOException { logger.debug(“Switch User failed”, failed); if (switchFailureUrl != null) {

+ request.setAttribute( “authenticationException”, failed );
sendRedirect(request, response, switchFailureUrl);
} else {
response.getWriter().print("Switch user failed: " + failed.getMessage());
response.flushBuffer();
}
}

  • Note: I am note sure if request attributes will transfer through a redirect; we could pass the failure message as a GET parameter perhaps?
@spring-issuemaster

Luke Taylor said:

switch user error handling has already been addressed as part of SEC-745 (see also SEC-959), so you should be able to customize the behaviour to accomodate any requirement by injecting a suitable strategy.

@spring-issuemaster

Luke Taylor said:

No further input, so closing.

@spring-issuemaster spring-issuemaster added this to the 3.0.0 M1 milestone Feb 5, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment