[jira] [Commented] (SLING-13025) Default(Jakarta)AuthenticationFeedbackHandler should evaluate "resource" parameter as fallback for "sling.auth.redirect"

["Eric Norman (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SLING-13025?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18126178#comment-18126178 ] 

Eric Norman commented on SLING-13025:
-------------------------------------

[~kwin] Can you maybe take another look at the solution that was done here?

After updating to the auth.core 2.1.0 release candidate in the starter project, I see a new NPE when attempting to render the custom form login page
 
Below is the stack trace that was logged:
{noformat}
08.10.2026 13:36:20.202 *ERROR* [qtp691698687-65] org.apache.felix.http Exception while processing request to /starter.login.html
java.lang.NullPointerException: Cannot invoke "org.apache.sling.api.resource.ResourceResolver.map(jakarta.servlet.http.HttpServletRequest, String)" because the return value of "org.apache.sling.auth.core.AuthUtil.getResourceResolver(jakarta.servlet.http.HttpServletRequest)" is null
at org.apache.sling.auth.core.AuthUtil.getMappedLoginResourcePath(AuthUtil.java:227) [org.apache.sling.auth.core:2.1.0]
at org.apache.sling.auth.core.spi.DefaultJakartaAuthenticationFeedbackHandler.getValidatedRedirectTarget(DefaultJakartaAuthenticationFeedbackHandler.java:105) [org.apache.sling.auth.core:2.1.0]
at org.apache.sling.auth.core.spi.DefaultJakartaAuthenticationFeedbackHandler.handleRedirect(DefaultJakartaAuthenticationFeedbackHandler.java:80) [org.apache.sling.auth.core:2.1.0]
at org.apache.sling.auth.core.impl.SlingAuthenticator.getAnonymousResolver(SlingAuthenticator.java:920) [org.apache.sling.auth.core:2.1.0]
at org.apache.sling.auth.core.impl.SlingAuthenticator.doHandleSecurity(SlingAuthenticator.java:552) [org.apache.sling.auth.core:2.1.0]
at org.apache.sling.auth.core.impl.SlingAuthenticator.handleSecurity(SlingAuthenticator.java:494) [org.apache.sling.auth.core:2.1.0]
at org.apache.sling.engine.impl.SlingHttpContext.handleSecurity(SlingHttpContext.java:121) [org.apache.sling.engine:3.0.4]{noformat}

> Default(Jakarta)AuthenticationFeedbackHandler should evaluate "resource" parameter as fallback for "sling.auth.redirect"
> ------------------------------------------------------------------------------------------------------------------------
>
>                 Key: SLING-13025
>                 URL: https://issues.apache.org/jira/browse/SLING-13025
>             Project: Sling
>          Issue Type: Improvement
>          Components: Authentication Core
>    Affects Versions: Auth Core 2.0.2
>            Reporter: Konrad Windszus
>            Assignee: Konrad Windszus
>            Priority: Major
>             Fix For: Auth Core 2.1.0
>
>
> As outlined in https://sling.apache.org/documentation/the-sling-engine/authentication/authentication-authenticationhandler/form-based-authenticationhandler.html#phase-1-form-submission
> {quote}
> The resource and sling.auth.redirect parameters provide similar functionality but with differing historical backgrounds. The resource parameter is based on the resource request attribute which is set by the login servlet to indicate the original target resource the client desired when it was forced to authenticate. The sling.auth.redirect parameter can be used by clients (applications like cURL or plain HTML forms) to request being redirected after successful login. If both parameters are set, the sling.auth.redirect parameter takes precedence.
> {quote}
> However the [DefaultJakartaAuthenticationFeedbackHandler|https://github.com/apache/sling-org-apache-sling-auth-core/blob/b8409ee840277cfaeb1f58c8648259b811f7789e/src/main/java/org/apache/sling/auth/core/spi/DefaultJakartaAuthenticationFeedbackHandler.java#L32C14-L32C57] and [DefaultAuthenticationFeedbackHandler|https://github.com/apache/sling-org-apache-sling-auth-core/blob/b8409ee840277cfaeb1f58c8648259b811f7789e/src/main/java/org/apache/sling/auth/core/spi/DefaultAuthenticationFeedbackHandler.java#L33] only evaluate {{sling.auth.redirect}}.
> In order to reduce the amount of parameters necessary it would be good to issue a redirect considering {{resource}} in case {{sling.auth.redirect}} is not set (as in most cases it is the desired behaviour to redirect to the resource which originally triggered the login).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)