Avoid index.php duplication in security redirects - #1646
Conversation
| // page, after a successful login you are redirected to a page in the previous | ||
| // locale. This code regenerates the referrer URL whenever the login page is | ||
| // browsed, to ensure that its locale is always the current one. | ||
| $this->saveTargetPath($request->getSession(), 'main', $this->generateUrl('admin_index')); |
There was a problem hiding this comment.
The Symfony\Component\Security\Http\Firewall\ExceptionListener class, part of the security core component, has stored an absolute URL. It should remain an absolute URL.
| // locale. This code regenerates the referrer URL whenever the login page is | ||
| // browsed, to ensure that its locale is always the current one. | ||
| $this->saveTargetPath($request->getSession(), 'main', $this->generateUrl('admin_index')); | ||
| $this->saveTargetPath($request->getSession(), 'main', $this->generateUrl('admin_index', [], \Symfony\Component\Routing\Generator\UrlGeneratorInterface::ABSOLUTE_URL)); |
There was a problem hiding this comment.
please add a use statement instead of using the FQCN inline
There was a problem hiding this comment.
Sure, I will do that. I did not do that first because I have seen recommendations elsewhere to the opposite when the namespace is used only once for a constant. It is done as you suggested.
f8a1396 to
1a704de
Compare
This change addresses environments where internal URL rewriting (e.g., via mod_rewrite) is unavailable, forcing the index.php entry point or script name to remain visible in the request path. When this 'dirty' absolute path is stored as a target for later redirection, Symfony's logic may prepend the script name again, resulting in duplication (e.g., /index.php/index.php/). Switching to an absolute URL (including scheme and host) prevents this re-processing. Fixes symfony#1645
1a704de to
8614419
Compare
|
The problem comes from how Symfony interprets the stored target during the post-authentication redirect.
When the user is redirected after login, the success handler uses that value directly to build the redirect response: If the stored value is an absolute path (e.g. In environments without URL rewriting (where the front controller must appear in the URL), this leads to duplicated front controllers: Symfony’s behavior can therefore be summarized as:
The demo currently stores an absolute path while implicitly expecting “no handling,” causing duplicated front controllers in non-rewritten setups. Storing a full absolute URL (this PR) makes the intent explicit and ensures correct behavior in all environments. |
2 participants
This change addresses environments where internal URL rewriting (e.g., via mod_rewrite) is unavailable, forcing the index.php entry point or script name to remain visible in the request path.
When this 'dirty' absolute path is stored as a target for later redirection, Symfony's logic may prepend the script name again, resulting in duplication (e.g., /index.php/index.php/). Switching to an absolute URL (including scheme and host) prevents this re-processing.
Fixes #1645