Drupal Version

10.4.*

Domain module version

2.0.0-beta2

Expected Behavior

The README file of Domain source states:

Domain Source changes core's `redirect_response_subscriber` service to the `DomainSourceRedirectResponseSubscriber` class. This allows us to issue redirects to registered domains and aliases that would otherwise not be recognizes as internal Drupal links. These redirects typically occur on entity save when the source domain varies from the current domain.

Actual Behavior

The service replacement is not made at all. Moreover, the event subscriber is clearly not up to date with the redirect_response_subscriber service. It should not copy the code from this service, as it will probably continue to evolve, but try to do as least as possible and rely on the parent method.

When requesting an URL for a page which source is defined to another domain, the user is not redirected to the correct domain

Steps to reproduce

Install Domain and Domain source

  • Create 2 domains, "A" and "B"
  • Make the login form
  • Make the "page" content type using the domain source field
  • Create a route related to domain "A" with role restrictions for example
  • Create a subscriber which extends "HttpExceptionSubscriberBase" and override the on403 method to redirect to user login
  • Make the login page allowed only for the "B" domain

The expected behavior is to have the user redirected from the A domain to the user login page on the "B" domain.

Instead we have an error page because the "redirect_response_subscriber" does not find a secured response.

Issue fork domain-3517215

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

b-prod created an issue. See original summary.

b-prod’s picture

Issue summary: View changes
b-prod’s picture

Status: Active » Needs review
StatusFileSize
new5.48 KB

The provided patch makes the "redirect_response_subscriber" to be replaced as expected, and simplify the code of the domain source event subscriber, so it relies more closely on its parent without duplicating the code.

mably’s picture

Status: Needs review » Needs work

Could you create a merge-request please?

And it could be interesting to have a functional test to cover that problem.

ben.hamelin made their first commit to this issue’s fork.

ben.hamelin’s picture

Assigned: Unassigned » ben.hamelin

Thanks @b-prod for opening this issue. Confirming the patch you provided worked for me.

@mably Opened the issue branch and am doing some further testing and development. I will open the MR soon hopefully!

mably’s picture

Priority: Major » Normal
Status: Needs work » Postponed (maintainer needs more info)

Is it still a problem? Could we have a MR please?

mably’s picture

Status: Postponed (maintainer needs more info) » Needs review

MR created. Please review.

We also need a test for this.

mably’s picture

Issue tags: +Needs tests
mably’s picture

Status: Needs review » Postponed (maintainer needs more info)

Why is it done in the domain_source submodule and not in the main domain module?

I do not see any reference to some domain_source specific code in the DomainSourceRedirectResponseSubscriber class.

Does your use case require the activation of the domain_source module?

If not, this should definitely be moved to the domain module. Will work on it.

mably’s picture

Had to add back some duplicated code from the RedirectResponseSubscriber class to properly handle the InvalidArgumentException that generates the status 400 message.

mably’s picture

Would be great to have more detailed instructions to help reproduce the problem.

mably’s picture

Status: Postponed (maintainer needs more info) » Needs review

I recommend enabling our domain-aware RedirectResponseSubscriber by default to prevent potential issues with custom cross-domain redirects.

MR code has been updated accordingly.

ben.hamelin’s picture

Status: Needs review » Reviewed & tested by the community

@mably - I agree with the approach here to move this from domain_source into domain.
Patch applies cleanly to drupal/domain (dev-2.0.x c210cf8)

I am able to add a redirect to a local domain managed by domain module.

I think this is good to go

mably’s picture

Assigned: ben.hamelin » Unassigned
Issue tags: -Needs tests, -Needs steps to reproduce +next-release

Added a functional test:

namespace Drupal\Tests\domain\Functional;

use Symfony\Component\HttpFoundation\Response;

/**
 * Tests the domain redirection handling.
 *
 * @group domain
 */
class DomainRedirectTest extends DomainTestBase {

  /**
   * {@inheritdoc}
   */
  protected static $modules = ['domain', 'domain_test_redirect'];

  /**
   * Test redirections.
   */
  public function testDomainRedirect() {
    $this->domainCreateTestDomains(2);

    $domains = $this->getDomains();
    $domain = $domains['one_example_com'];

    // Redirection targeting a registered domain url.
    $target_url = $domain->getPath() . 'target-path';
    $this->drupalGet('/non-trusted-redirect', [
      'query' => ['url' => $target_url],
    ]);

    // Check that the redirection has been properly allowed.
    $this->assertEquals($target_url, $this->getUrl());

    // Target an external url that is not a registered domain.
    $target_url = 'https://two.example.com';
    $this->drupalGet('/non-trusted-redirect', [
      'query' => ['url' => $target_url],
    ]);

    // Verify that the redirection was rejected as expected.
    $this->assertSession()->statusCodeEquals(Response::HTTP_BAD_REQUEST);
    $this->assertSession()->responseContains('Redirects to external URLs are not allowed');

  }

}

We should be ready to go.

  • mably committed aa1e3c19 on 2.0.x
    Issue #3517215 by ben.hamelin: The replacement of service "...
mably’s picture

Status: Reviewed & tested by the community » Fixed
Issue tags: -next-release

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.