CakeDC/users

CakeDC Users plugin returns full request URL instead of just path part

TerryKern opened this issue · 0 comments

CakePHP: 4.x (in upgrade process from 3.x)
CakeDC/Users plugin: 9.3.1 (in upgrade process from 8.5.x)

We noticed during out upgrading that the behaviour of the login redirect has changed.
Before, with CakePHP 3.x, the login redirect URL contained only the path part of the requested URL.
With CakePHP 4.x and the new Users plugin, it returns the full request URL.

CakePHP 3.x: /login?redirect=%2Fcontroller-name%2Faction-name%2F1
CakePHP 4.x: /login?redirect=http%3A%2F%2Flocalhost%2Fcontroller-name%2Faction-name%2F1

Is there a particular reason for this behaviour change?
Also, it seems the redirect handlers of CakePHP Authorization plugin behave differently (like before).
If not, could the behaviour be adjusted to CakePHP's behaviour?

CakeDC/Users plugin redirect handler returns the full URL as login redirect query parameter
https://github.com/CakeDC/users/blame/11.1.0/src/Middleware/UnauthorizedHandler/DefaultRedirectHandler.php#L81

Before, CakeDC/Users plugin used CakePHP Authorization plugin's CakeRedirect handler
ed009e9#diff-edbb01d537d2d3f2f3c4988703da9866d7065bcf689034316f75a9f1a1f10707L202

Both CakePHP Authorization plugin redirect handlers return only the path (and query parameters) as login redirect query parameter
https://github.com/cakephp/authorization/blob/90c3a6556d2263b4a1970dfad8110ba06fba197f/src/Middleware/UnauthorizedHandler/RedirectHandler.php#L103-L107
https://github.com/cakephp/authorization/blob/90c3a6556d2263b4a1970dfad8110ba06fba197f/src/Middleware/UnauthorizedHandler/CakeRedirectHandler.php#L71-L75

The CakePHP Authorization plugin redirect handlers changed their behaviour in the following commit:
cakephp/authorization@1569b7c