[SLING-2126] Apply some validation to requested redirects after authentication

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Auth Core 1.0.6
• Fix Version/s: Auth Core 1.1.0
• Component/s: Authentication
• Assignee: Felix Meschberger
• Reporter: Felix Meschberger
• Created: 05/Jul/11 09:42
• Updated: 30/Nov/12 17:56
• Resolved: 18/Nov/11 22:02

Description

Currently the DefaultAuthenticationFeedbackHandler.handleRedirect and AbstractAuthenticationHandler.sendRedirect methods do not apply any validity checks on the requested redirect target.

We should apply some checks to ensure a valid target is accessible within the Sling application. If the target is not valid, the methods would redirect to the servlet context root path – obeying the contract for redirecting the client but not necessairily to the desired target. In any case an ERROR level message is written to the log indicating why the redirect target is not being honoured.

This check should be made available to AuthenticationHandler implementations such that they may apply checks to their own redirects.