Fixed: Remove _PREVIOUS_REQUEST_ Session Attribute on non-authentication
pages
Added removal of the _PREVIOUS_REQUEST_ attribute when requesting
non-authenticated sites and moved targetRequestUri handling to a
accommodate this change
@@ -383,13 +383,6 @@ public final class RequestHandler {
// Grab data from request object to process
String defaultRequestUri = RequestHandler.getRequestUri(request.getPathInfo());
- if (request.getAttribute("targetRequestUri") == null) {
- if (request.getSession().getAttribute("_PREVIOUS_REQUEST_") != null) {
- request.setAttribute("targetRequestUri", request.getSession().getAttribute("_PREVIOUS_REQUEST_"));
- } else {
- request.setAttribute("targetRequestUri", "/" + defaultRequestUri);
- }
- }
String requestMissingErrorMessage = "Unknown request ["
+ defaultRequestUri
@@ -636,6 +629,17 @@ public final class RequestHandler {
requestMap = ccfg.getRequestMapMap().get("ajaxCheckLogin");
}
}
+ } else {
+ // Remove previous request attribute on navigation to non-authenticated request
+ request.getSession().removeAttribute("_PREVIOUS_REQUEST_");
+ }
+
+ if (request.getAttribute("targetRequestUri") == null) {
+ if (request.getSession().getAttribute("_PREVIOUS_REQUEST_") != null) {
+ request.setAttribute("targetRequestUri", request.getSession().getAttribute("_PREVIOUS_REQUEST_"));
+ } else {
+ request.setAttribute("targetRequestUri", "/" + defaultRequestUri);
+ }
}
// after security check but before running the event, see if a post-login redirect has completed and we have data from the pre-login
