[SLING-3443] Parameter based redirection in FormAuthenticationHandler should not handle absolute urls

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: Form Based Authentication 1.0.2
• Fix Version/s: Form Based Authentication 1.0.6
• Component/s: Authentication
• Assignee: Carsten Ziegeler
• Reporter: Raviteja Lokineni
• Created: 08/Mar/14 06:22
• Updated: 11/Aug/14 14:16
• Resolved: 11/Mar/14 11:22

Description

Suppose your login url is: http://blah/blah?resource=http://www.google.com

Then after login succeeds, user would be redirected to http://www.google.com

Will be submitting a pull request for this.

Issue Links

• relates to: SLING-3141 AbstractAuthenticationFormServlet should make sure resource is a valid redirect