{"action":"created","issue":{"url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/875","labels_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/875/labels{/name}","comments_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/875/comments","events_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/875/events","html_url":"https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/875","id":97019215,"number":875,"title":"OpenID Login Form forgets originating redirect URL","user":{"login":"bertramn","id":3828133,"avatar_url":"https://avatars.githubusercontent.com/u/3828133?v=3","gravatar_id":"","url":"https://api.github.com/users/bertramn","html_url":"https://github.com/bertramn","followers_url":"https://api.github.com/users/bertramn/followers","following_url":"https://api.github.com/users/bertramn/following{/other_user}","gists_url":"https://api.github.com/users/bertramn/gists{/gist_id}","starred_url":"https://api.github.com/users/bertramn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bertramn/subscriptions","organizations_url":"https://api.github.com/users/bertramn/orgs","repos_url":"https://api.github.com/users/bertramn/repos","events_url":"https://api.github.com/users/bertramn/events{/privacy}","received_events_url":"https://api.github.com/users/bertramn/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-07-24T10:11:15Z","updated_at":"2015-07-24T11:15:21Z","closed_at":null,"body":"We are encountering a rather significant problem with the login/redirect mechanism. Our observation is as followed: \r\n\r\n1) a user accesses a protected site\r\n2) relying party redirects a user to the mitreid server login page \r\n3) login page is presented but not submitted by the user straight away\r\n4) say after 45 minutes user enters credentials and presses login\r\n5) mitreid server accepts login form post and authenticates user\r\n6) mitreid server can't remember why it authenticated the user and redirects the user to the root of itself\r\n\r\nMost probably the servlet session that is created in step 3) holds the redirect URL but as time goes on the servlet session times out. When the login form is finally posted in step 5), tomcat creates another servlet session which does not have the redirect information hence mitreid forced to present the default page of self.\r\n\r\nThe login form (hidden form field) or a cookie in the clients user agent should really be holding the target redirect information and not the tomcat servlet session (obviously together with a CSFR token). \r\n\r\nIs that a bug or are we just looking at a configuration issue?"},"comment":{"url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/comments/124479247","html_url":"https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/875#issuecomment-124479247","issue_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/875","id":124479247,"user":{"login":"praseodym","id":20283,"avatar_url":"https://avatars.githubusercontent.com/u/20283?v=3","gravatar_id":"","url":"https://api.github.com/users/praseodym","html_url":"https://github.com/praseodym","followers_url":"https://api.github.com/users/praseodym/followers","following_url":"https://api.github.com/users/praseodym/following{/other_user}","gists_url":"https://api.github.com/users/praseodym/gists{/gist_id}","starred_url":"https://api.github.com/users/praseodym/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/praseodym/subscriptions","organizations_url":"https://api.github.com/users/praseodym/orgs","repos_url":"https://api.github.com/users/praseodym/repos","events_url":"https://api.github.com/users/praseodym/events{/privacy}","received_events_url":"https://api.github.com/users/praseodym/received_events","type":"User","site_admin":false},"created_at":"2015-07-24T11:15:21Z","updated_at":"2015-07-24T11:15:21Z","body":"Spring Security's CSRF protection works using servlet sessions, so when the session expires server-side it should throw a HTTP 403 error. I'd be against storing data in cookies or in the form, since that'd require server-side validation which would be impossible without a session anyway."}}