Odtnhj

We have an application using Spring Security(Version 4.0.3.RELEASE). When a user goes to an endpoint https://system.com/app/accountSummary?accountId=230 they get redirected to another page and the redirect page is set as we see this in the log:

DefaultSavedRequest added to Session: DefaultSavedRequest[http://system.com/app/accountSummary?accountId=230]

We then redirect them to a main page. When our user clicks to login it resets the DefaultSavedRequest. We see this in the logs: DefaultSavedRequest added to Session: DefaultSavedRequest[http://system.com/app/mainpage]

After the user logs in properly Spring Security is taking them back to the mainpage not the account screen they wanted.

Is there a way to stop the DefaultSavedRequest from updating or check if it is set and not update it?
Is it possible to do something at the page level? Or should I do this in a different fashion.

A teammate of mine created this solution:
AuthenticationPoint.java

SavedRequest savedRequest = null;
 if (request.getSession().getAttribute(ORIG_SAVED_REQUEST_URL) != null)
 saveURL = request.getSession().getAttribute(ORIG_SAVED_REQUEST_URL).toString();
 savedRequest = (SavedRequest) request.getSession().getAttribute(ORIG_SAVED_REQUEST);
 request.getSession().setAttribute(ORIG_SAVED_REQUEST_URL, saveURL);
 request.getSession().setAttribute(ORIG_SAVED_REQUEST, savedRequest);
 request.getSession().setAttribute(SPRING_SECURITY_SAVED_REQUEST, savedRequest);
 logger.debug("Session Variable ORIG-SAVED-REQUEST=",savedRequest.getRedirectUrl());
 

Then in Controller.java

if ((request != null) && (request.getSession() != null) &&
 (request.getSession().getAttribute(SPRING_SECURITY_SAVED_REQUEST) != null) )
 savedRequest = (SavedRequest) request.getSession().getAttribute(SPRING_SECURITY_SAVED_REQUEST);
 request.getSession().setAttribute(ORIG_SAVED_REQUEST_URL, savedRequest.getRedirectUrl());
 request.getSession().setAttribute(ORIG_SAVED_REQUEST, savedRequest);
 logger.debug("Session Variable ORIG-SAVED-REQUEST=",savedRequest.getRedirectUrl());
 

Then he added this to the spring security xml:

<property name="alwaysUseDefaultTargetUrl"><value>false</value></property>

These changes resolved the issue in our application.