From 057e5181ea4f1b3ae31acd6cc0bfa78c91ab9699 Mon Sep 17 00:00:00 2001 From: Josh Cummings <3627351+jzheaux@users.noreply.github.com> Date: Wed, 25 Mar 2026 15:05:53 -0600 Subject: [PATCH] Adjust Formatting Issue gh-18805 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com> --- .../AbstractAuthenticationTargetUrlRequestHandler.java | 5 ++++- .../AbstractAuthenticationTargetUrlRequestHandlerTests.java | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationTargetUrlRequestHandler.java b/web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationTargetUrlRequestHandler.java index ac29baec94..f91140dd75 100644 --- a/web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationTargetUrlRequestHandler.java +++ b/web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationTargetUrlRequestHandler.java @@ -114,7 +114,10 @@ public abstract class AbstractAuthenticationTargetUrlRequestHandler { } String refererHeader = request.getHeader("Referer"); - if (this.useReferer && StringUtils.hasText(refererHeader)) { + if (!StringUtils.hasText(refererHeader)) { + return this.defaultTargetUrl; + } + if (this.useReferer) { trace("Using url %s from Referer header", refererHeader); return refererHeader; } diff --git a/web/src/test/java/org/springframework/security/web/authentication/AbstractAuthenticationTargetUrlRequestHandlerTests.java b/web/src/test/java/org/springframework/security/web/authentication/AbstractAuthenticationTargetUrlRequestHandlerTests.java index 8e434bf5ae..8b744dd250 100644 --- a/web/src/test/java/org/springframework/security/web/authentication/AbstractAuthenticationTargetUrlRequestHandlerTests.java +++ b/web/src/test/java/org/springframework/security/web/authentication/AbstractAuthenticationTargetUrlRequestHandlerTests.java @@ -114,6 +114,7 @@ public class AbstractAuthenticationTargetUrlRequestHandlerTests { assertThatIllegalArgumentException().isThrownBy(() -> this.handler.setRedirectStrategy(null)); } + // gh-18805 @Test void returnDefaultUrlIfUseRefererIsTrueAndRefererHeaderIsEmpty() { this.handler.setUseReferer(true);