dlindahl / omniauth-cas

A CAS OmniAuth Strategy
MIT License
88 stars 79 forks source link

Preserve `url` parameter from POST body; don't append nil referer #67

Open dmolesUC opened 2 years ago

dmolesUC commented 2 years ago

Previously, we were looking for request.params['url'], and assuming that if it was present, it would be in the original query string and OmniAuth would already have appended it to the callback URL.

With this change, the behavior for a url parameter in the query string (Rack::Request#GET) is unchanged. However, if there is no url parameter in the query string, but there is one in the form body (Rack::Request#POST), we transfer the value from the form body to the callback URL query string.

As a fallback, we use the HTTP Referer value, just as OmniAuth does for the origin parameter. However, we were previously appending it unconditionally, whether or not it was actually present (as it often isn’t, for various reasons), resulting in an empty url query parameter in the callback URL. With this change, we now only append the referrer if non-nil.

Fixes #66.