It's important to respect REST request. In some cases, you want to redirect all users who're using their browsers but what if you are using REST to create user accounts, browsing some content...etc

Currently REST APIs are interrupted with 302 redirect response. This patch simply check if any Content-Type exist in the header and it will ignore the redirect if the Content-Type exist.

TODO:
We can add option in settings form to respect REST requests.

QUESTIONS:
Should we check _format parameter as REST request indicator instead of the Content-Type?

CommentFileSizeAuthor
#6 anonymouse_redirect_3124768_6.patch1.16 KBmeladawy
#4 anonymouse_redirect_3124768_4.patch4.28 KBbradhawkins
#2 anonymouse_redirect_3124768_1.patch1.18 KBmeladawy

Comments

meladawy created an issue. See original summary.

meladawy’s picture

meladawy commented
StatusFileSize
new anonymouse_redirect_3124768_1.patch1.18 KB
hexblot’s picture

hexblot commented
Status: Active » Needs work

I am having some trouble with this request:

  • Content-Type is not a strong indicator of the nature of the request (eg forms should have their Content-Type set to "multipart/form-data" if they have files to sent).
  • _format is another weak indicator since it is by default ignored for many API endpoints (eg JSON:API does not use it for its own endpoints)

If we can find a way to reliably differentiate between interactive web requests and API requests (REST/JSON:API/other), I'm all for implementing this.

bradhawkins’s picture

bradhawkins commented
StatusFileSize
new anonymouse_redirect_3124768_4.patch4.28 KB

Here's a patch that allows for "Whitelisted Referer Overrides" which allows the admin to enter a list of referring domains that should be excluded from redirection.

Obviously, this won't work in every situation, but for sites where the backend uses a different domain from the front-end, this can provide a solution.

meladawy’s picture

meladawy commented
Issue summary: View changes
meladawy’s picture

meladawy commented
StatusFileSize
new anonymouse_redirect_3124768_6.patch1.16 KB

This patch is following the same old approach as in #2 but compatible with the latest release.