Uploaded image for project: 'Shibboleth SP - C++'
  1. Shibboleth SP - C++
  2. SSPCPP-518

Incorrect requireLogoutWith redirection if the original URL has query string

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 2.5.0
    • Fix Version/s: 2.5.1
    • Component/s: None
    • Labels:
      None
    • Operating System:
      Multiple
    • CPU Type:
      Multiple
    • C/C++ Compiler:
      Multiple
    • Web Server:
      Multiple

      Description

      If you have the following setting,

      <Location /secure/logout>
        require shibboleth
        ShibRequestSetting requireSession false
        ShibRequestSetting requireLogoutWith "/Shibboleth.sso/Logout"
      </Location>
      

      the access to

      /secure/logout?param=aaa

      incorrectly redirect to the following URL after the Shib logout process.

      /secure/logout?param=aaashiblogoutdone=1

      '&' should be added.

      With no query string, all things work as expected.

      I attached a patch for this problem.

        Attachments

        1. shibsp-2.5.0-addamp.patch
          0.6 kB
          (not used) Takeshi Nishimura

          Activity

            People

            Assignee:
            cantor.2@osu.edu Scott Cantor
            Reporter:
            lpn21gf1zqxox2a5ku6+txn8kw8=@https://idp.gakunin.nii.ac.jp/idp/shibboleth (not used) Takeshi Nishimura
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:

                Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 10 minutes
                10m