Skip to content

[4] After authentication failure, return to the login page with a GET request#32897

Merged
rdeutz merged 3 commits intojoomla:4.0-devfrom
PhilETaylor:faillogintoget
Mar 30, 2021
Merged

[4] After authentication failure, return to the login page with a GET request#32897
rdeutz merged 3 commits intojoomla:4.0-devfrom
PhilETaylor:faillogintoget

Conversation

@PhilETaylor
Copy link
Contributor

Pull Request for Issue # #32895

Summary of Changes

After attempting to login with invalid credentials, you are not redirected back to the login page, so pressing refresh actually attempts to send the POST request a second time.

Administrator login form doesn't follow Post/Redirect/Get pattern

(also a quick typo fix in comment)

Testing Instructions

Attempt to login to Joomla 4 with invalid credentials.
Inspect the requests/responses with browser inspector tools

Actual result BEFORE applying this Pull Request

Request: POST of invalid credentials
Response: HTML with error message, if you refresh the page the browser asks to resend the form

Expected result AFTER applying this Pull Request

Request: POST of invalid credentials
Response: 303 Other redirect to /administrator/index.php
browser follows redirect (not always shown in the inspector on some browsers, look hard, it fooled me too)
Response: GET /administrator/index.php, if you refresh the page the browser just performs a refresh (GET) and validation message is missing as its already displayed

Documentation Changes Required

none

Signed-off-by: Phil E. Taylor <phil@phil-taylor.com>
Phil E. Taylor added 2 commits March 28, 2021 17:56
Signed-off-by: Phil E. Taylor <phil@phil-taylor.com>
Signed-off-by: Phil E. Taylor <phil@phil-taylor.com>
@toivo
Copy link
Contributor

toivo commented Mar 29, 2021

I have tested this item ✅ successfully on 5fe0333

Tested successfully in Beta8-dev updated to 29 March in Windows 10 running Wampserver 3.2.4 and PHP 8.0.2.


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/32897.

@ceford
Copy link
Contributor

ceford commented Mar 29, 2021

I have tested this item ✅ successfully on 5fe0333

I used the Firefox live headers and selected a un/pw not for my test site - surprised to see the pw in plain text in the record! A sobering lesson!


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/32897.

@Quy
Copy link
Contributor

Quy commented Mar 29, 2021

RTC


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/32897.

@joomla-cms-bot joomla-cms-bot added the RTC This Pull Request is Ready To Commit label Mar 29, 2021
@Quy Quy added this to the Joomla 4.0 milestone Mar 29, 2021
@rdeutz rdeutz merged commit b7e0fc7 into joomla:4.0-dev Mar 30, 2021
@joomla-cms-bot joomla-cms-bot removed the RTC This Pull Request is Ready To Commit label Mar 30, 2021
dgrammatiko pushed a commit to dgrammatiko/joomla-cms that referenced this pull request Apr 2, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants