Details
-
Bug
-
Resolution: Fixed
-
Critical
-
6.2.9
-
None
-
Empty show more show less
-
Yes
-
Maintenance 62, Maintenance 62
-
5
Description
Steps to reproduce
- Open https://demo.magnolia-cms.com/
- Fill in credentials on login page
- Inspect network in browser
Expected results
- Request is only redirect to original URL I've entered (https://demo.magnolia-cms.com/) after login.
Actual results
- The request is redirected to http, then back to https.
- Since Chrome v90, this works only if cross site cookies are allowed.
Workaround
<CookieProcessor sameSiteCookies="None" />
Development notes
LoginFilter#getRedirectLocation redirects to absolute URL in case of the self redirect (to the browser URL user accessed before login and which was forwarded to login page), which might be http behind proxy although the browser uses https. Changing this to relative (URI) might fix the issue.
Logout suffers from the same issue https://git.magnolia-cms.com/projects/PLATFORM/repos/main/browse/magnolia-core/src/main/java/info/magnolia/cms/security/LogoutFilter.java#98
Checklists
Attachments
Issue Links
- relates to
-
MGNLSSO-56 Session lost & authentication broken with CookieProcessor sameSiteCookies="Strict"
-
- Open
-
-
MGNLSSO-65 CLONE - Session lost & authentication broken with CookieProcessor sameSiteCookies="Strict"
-
- Closed
-
- mentioned in
-
Page Loading...