VaadinSavedRequestAwareAuthenticationSuccessHandler redirects to the wrong URL if login is not in the application root

Description of the bug

If you have a public view at /hello, a private view at /foo and a login view at /my/login where the public view has a link to the private view, then when you click the link you will end up on the login form and after login you will end up on /my/foo instead of /foo

The reason is that ViewAccessChecker stores the target view it gets from beforeEnterEvent.getLocation().getPathWithQueryParameters(). This is relative path so in this case foo.

The login POST goes to /my/login and the response to that is a redirect to “foo”, which the browser then interprets as /my/foo

If you instead open /foo directly, then it is not ViewAccessChecker that saves the target URL but instead VaadinDefaultRequestCache using HttpSessionRequestCache. This in turn stores the full request and provides the redirect URL as a full URL, e.g. http://localhost:8080/foo

Expected behavior

You should end up on the page you tried to navigate to.

Minimal reproducible example

As described above

Versions

• Vaadin / Flow version: 23.2.1

[taefi]

I move this to P1 as it needed to be fixed before #14253 (which is a BFP).

[vaadin-bot]

This ticket/PR has been released with Vaadin 23.1.11.