Overview
When building a dynamic login link that uses the current page path in the following format /caslogin?returnto=<CURRENT-PAGE-PATH>, the first login will return you to the proper page, but if you log out, go to another page, and log back in, you will not be returned to the correct page. Instead, you will be returned to the page that your first login returned you to. Clearing the cache will resolve the problem for one iteration. In short, some caching bug is making the returnto parameters only work successfully for the first login in a cache cycle.
Dynamic Login Twig code
{% if logged_in %}
<a href="/user/logout">Log Out</a>
{% else %}
<a href="/caslogin{% if not is_front %}?returnto={{ path('<current>') }}{% endif %}">Log In</a>
{% endif %}
Steps leading to bug
- clear all site cache
- go to
/some/page/x
- click
Log In link, which points to http://<MY-SITE>/caslogin?returnto=/some/page/x
- You are successfully logged in and returned to
/some/page/x
- Click
Log Out link, which return you to the home page
- go to
/some/page/y
- click
Log In link, which points to http://<MY-SITE>/caslogin?returnto=/some/page/y
- You are authenticated, but inaccurately returned to
/some/page/x
- You can clear all site cache and the first login redirect will return you to the correct page, but subsequent login redirects won't
Comments
Comment #2
xem8vfdh commentedComment #3
bkosborneThanks for the report! Indeed, this is a bug with wrong cache contexts being set on the redirect response to the CAS server. This patch fixes it, and fixes a test to test against this regression.
Comment #8
bkosborneFailures are unrelated to this patch. Looks like it's due to something in 8.4 instead. Will look at separately.
Comment #9
xem8vfdh commentedThanks @bkosborne! I may have a chance to review this patch today. Do you want me to hold off due to the testing failures you mentioned, or since they don't relate to this patch do you think its safe for me to move forward with review as soon as I can?
Comment #10
bkosborneThe patch was committed and released as part of 8.0-rc1 this past weekend. Try upgrading to that, then testing again. If still an issue, you can re-open.
Comment #11
xem8vfdh commentedI will test it, but, as it turns out, this is one of the cache weirdnesses that I've seen disappear after making the fix here: https://www.drupal.org/node/2694895#comment-12084564
Comment #12
xem8vfdh commentedJust tested update, and the dynamic login is working as expected, thanks again for the quick fix