R4032Login incompatible with the domain source module

Created on 4 April 2025, 21 days ago

Firstly, thank you very much for the extremely helpful module.

Problem/Motivation

The R4032LoginSubscriber attempts to check if the redirect URL is external. However, this check is inadequate when the module is used together with any contrib module (or custom code for that matter) that does outbound URL processing which results in the login URL being external. Any example is the domain source module. Using r4302login together with the domain_source module results in a fatal exception.

Steps to reproduce

Install r4302login
Install domain source module (sub module of the domain module).
Configure the node to have a source of domain A.
Restrict content to logged in users (e.g. using any module, such as https://www.drupal.org/project/tac_lite ) so that a 403 response is generated when requesting the node).
Attempt to open the node as a non-authenticated user on domain B.
Fatal exception "Redirects to external URLs are not allowed by default, use \Drupal\Core\Routing\TrustedRedirectResponse for it."

Proposed resolution

Check again if the URL is external, before creating the CacheableRedirectResponse and create a TrustedRedirectResponse if it is external.

Remaining tasks

MR to follow.

User interface changes

None.

API changes

None.

Data model changes

None

🐛 Bug report
Status

Active

Version

2.2

Component

Code

Created by

🇨🇭Switzerland tcrawford

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024