Non-AJAX login with ?destination= skips the redirect to /2fa/login

Problem/Motivation

This happens when JavaScript is disabled or the AJAX submit fails, and the user submits /user/login?destination=/node/1 for a 2FA-enabled account:

1. The module sets the redirect to /2fa/login.
2. Core's RedirectResponseSubscriber replaces that redirect with the destination query parameter.
3. The user lands on the destination page still anonymous, with a challenge pending. They are only sent to the challenge once they visit a page that anonymous users can't access.

The destination has already been saved in LoginChallengeManager::startPending(), so it isn't lost if the query parameter is dropped.

Steps to reproduce

1. Enable 2FA for a user.
2. With JavaScript disabled, open /user/login?destination=/node/1 (any page anonymous users can view) and log in with the password.
3. You end up on /node/1 as an anonymous visitor instead of on /2fa/login.

Proposed resolution

After saving the destination, remove the destination query parameter from the request, or call RedirectResponseSubscriber::setIgnoreDestination(). TFA does the former in TfaLoginFormHelper.

Remaining tasks

• Merge request
• Test coverage

Code references

• auth_login_plus.module L116-126
• LoginChallengeManager.php L154-160
• Core: core/lib/Drupal/Core/EventSubscriber/RedirectResponseSubscriber.php, checkRedirectUrl()

Generated with the help of an LLM.