-
Type: Bug
-
Status: Resolved
-
Priority: Major
-
Resolution: Fixed
-
Affects Version/s: None
-
Component/s: Authentication
-
Release Notes Summary:The page requested after login is correctly detected by the NuxeoAuthenticationFilter.
-
Tags:
-
Sprint:nxFG 10.1.2
-
Story Points:5
NuxeoAuthenticationFilter.getRequestedPage does not correctly analyze the requested URL to deduce the requested page.
The impact is that the authentication filter could fail to properly redirect to the login page or return a 401, and instead serve the requested URL directly. However this is not in itself a security issue, as the user is still not authenticated in this case.
Parsing of URL and the servlet spec is detailed here:
https://stackoverflow.com/questions/4931323/whats-the-difference-between-getrequesturi-and-getpathinfo-methods-in-httpservl#21046620
https://codebox.net/pages/java-servlet-url-parts
- is related to
-
NXP-19267 Nuxeo URL should not insert `_old` over and over.
- Resolved