Uploaded image for project: 'Undertow'
  1. Undertow
  2. UNDERTOW-1308

Incorrect handling of non http(s) scheme urls in sendRedirect

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Major Major
    • 2.0.2.Final, 1.4.24.Final
    • 1.4.23.Final, 2.0.1.Final
    • Servlet
    • None

      HttpServletResponseImpl#sendRedirect checks for absolute urls by recognizing string "://".

      The schema part of URLs ends with colon, not colon double slash. This is not an issue for http(s) protocol URLs but for redirect URLs for native mobile apps.

      Defining redirect URLs for OAuth as defined in
      https://tools.ietf.org/html/rfc8252#section-7.1
      will result in relative URL redirects.

              sdouglas1@redhat.com Stuart Douglas (Inactive)
              andre.schaefer André Schäfer (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: