[jira] [Updated] (DELTASPIKE-880) Restrict initial redirect to GET requests

["Gerhard Petracek (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/DELTASPIKE-880?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Gerhard Petracek updated DELTASPIKE-880:
----------------------------------------
    Fix Version/s:     (was: 1.4.1)
                   1.4.0

> Restrict initial redirect to GET requests
> -----------------------------------------
>
>                 Key: DELTASPIKE-880
>                 URL: https://issues.apache.org/jira/browse/DELTASPIKE-880
>             Project: DeltaSpike
>          Issue Type: Improvement
>          Components: JSF-Module
>    Affects Versions: 1.0.2, 1.3.0
>         Environment: JBoss EAP 6.x, JSF 2.1, JAAS
>            Reporter: Marco Bulau
>            Assignee: Thomas Andraschko
>             Fix For: 1.4.0
>
>
> We are using DeltaSpike in a web application that is secured by JAAS.
> If a user tries to login with wrong username or password, the user will be forwarded to a login error page configured in web.xml (form-error-page). The URL of the error page contains the POST parameters from login form (j_username and j_password) in plain text:
> http://example.com/webapp/userLoginError.xhtml?j_password=mypassword&j_username=myusername&dswid=8159
> so the POST parameters are applied to the redirect by DeltaSpike.
> Restrict the initial redirect to GET requests could be a solution for it, discussed on user mailing list.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)