[DELTASPIKE-880] Restrict initial redirect to GET requests

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.0.2, 1.3.0
• Fix Version/s: 1.4.0
• Component/s: JSF-Module
• Environment: JBoss EAP 6.x, JSF 2.1, JAAS
• Assignee: Thomas Andraschko
• Reporter: Marco Bulau
• Created: 23/Apr/15 12:49
• Updated: 23/Nov/19 19:36
• Resolved: 28/Apr/15 19:17

Description

We are using DeltaSpike in a web application that is secured by JAAS.

If a user tries to login with wrong username or password, the user will be forwarded to a login error page configured in web.xml (form-error-page). The URL of the error page contains the POST parameters from login form (j_username and j_password) in plain text:

http://example.com/webapp/userLoginError.xhtml?j_password=mypassword&j_username=myusername&dswid=8159

so the POST parameters are applied to the redirect by DeltaSpike.

Restrict the initial redirect to GET requests could be a solution for it, discussed on user mailing list.

Issue Links

• is related to: DELTASPIKE-1393 POST request from a non-JSF to a JSF page fails with when ds:windowId is used