Don't change host:port in redirect after successful login

labkey-matthewb · labkey-matthewb · commit 83f1c96b7de3 · 2025-06-19T12:20:22.000-07:00
diff --git a/core/src/org/labkey/core/login/LoginController.java b/core/src/org/labkey/core/login/LoginController.java
@@ -672,8 +672,8 @@ else if (form.getTermsOfUseType() == TermsOfUseType.SITE_WIDE)
                     response.put("approvedTermsOfUse", true);
                 }
 
-                // Use the full hostname in the URL if we have one, otherwise just go with a local URI
-                String redirectString = redirectUrl.getHost() != null && redirectUrl.getScheme() != null ? redirectUrl.getURIString() : redirectUrl.toString();
+                // Use relative path.  If the host in the URL changes then our session won't follow us, and we won't be logged in (that kinda defeats the purpose of this API)
+                String redirectString = redirectUrl.getLocalURIString();
 
                 if (null != user)
                 {

Original file line number	Diff line number	Diff line change
`@@ -672,8 +672,8 @@ else if (form.getTermsOfUseType() == TermsOfUseType.SITE_WIDE)`
`672`	`672`	`response.put("approvedTermsOfUse", true);`
`673`	`673`	`}`
`674`	`674`
`675`		`- // Use the full hostname in the URL if we have one, otherwise just go with a local URI`
`676`		`- String redirectString = redirectUrl.getHost() != null && redirectUrl.getScheme() != null ? redirectUrl.getURIString() : redirectUrl.toString();`
	`675`	`+ // Use relative path. If the host in the URL changes then our session won't follow us, and we won't be logged in (that kinda defeats the purpose of this API)`
	`676`	`+ String redirectString = redirectUrl.getLocalURIString();`
`677`	`677`
`678`	`678`	`if (null != user)`
`679`	`679`	`{`