Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2026-03-30 14:08:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fallback defaultTargetUrl if refererHeader is empty

Browse Source 
Closes gh-18805

Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
This commit is contained in:
Tran Ngoc Nhan 2026-02-26 23:07:48 +07:00 committed by Josh Cummings
parent 61ccf14953
commit 178ca56aaf
2 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationTargetUrlRequestHandler.java
View File

@ -112,9 +112,11 @@ public abstract class AbstractAuthenticationTargetUrlRequestHandler {
trace("Using url %s from request parameter %s", targetUrlParameterValue, this.targetUrlParameter);
return targetUrlParameterValue;
}
if (this.useReferer) {
trace("Using url %s from Referer header", request.getHeader("Referer"));
return request.getHeader("Referer");
String refererHeader = request.getHeader("Referer");
if (this.useReferer && StringUtils.hasText(refererHeader)) {
trace("Using url %s from Referer header", refererHeader);
return refererHeader;
}
return this.defaultTargetUrl;
}

7
web/src/test/java/org/springframework/security/web/authentication/AbstractAuthenticationTargetUrlRequestHandlerTests.java
View File

@ -114,4 +114,11 @@ public class AbstractAuthenticationTargetUrlRequestHandlerTests {
assertThatIllegalArgumentException().isThrownBy(() -> this.handler.setRedirectStrategy(null));
}
@Test
void returnDefaultUrlIfUseRefererIsTrueAndRefererHeaderIsEmpty() {
this.handler.setUseReferer(true);
this.request.addHeader("Referer", "");
assertThat(this.handler.determineTargetUrl(this.request, this.response)).isEqualTo(DEFAULT_TARGET_URL);
}
}