[SLING-9812] AccessManager Post servlets should not allow redirects to other hosts

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: JCR Jackrabbit Access Manager 3.0.8
• Assignee: Eric Norman
• Reporter: Eric Norman
• Created: 11/Oct/20 20:41
• Updated: 19/Oct/20 17:54
• Resolved: 11/Oct/20 21:40

Description

Through the :redirect parameter of the AbstractAccessPostServlet arbitrary redirects are possible. That should be limited so that redirects to other servers are not possible.

 

Expected: Apply the same solution that was applied to SlingPostServlet for SLING-4469