3 ms·
Tip from me: If the user tries to visit a specific URL and they have to log in first, redirect the user back to the original URL once they've logged in instead
by seanwilson 5y ago
Tip from me: If the user tries to visit a specific URL and they have to log in first, redirect the user back to the original URL once they've logged in instead of sending them to some generic account page. It's super annoying and disorientating otherwise.
- jpalomaki 5y agoJust be careful where you redirect the user to. Redirects without validating the destination may be used for malicious purposes.
- cratermoon 5y agoIdeally the site should store the destination in something like redis or memcached and hand the browser an endpoint with an opaque token for the redirect. After login the endpoint gets the token, looks up the actual destination, and does a final redirect. The bonus to this method is that the site can store more than just the destination, but keep useful state, as long as that state is safe across authentication boundaries.
- cratermoon 5y agoOh I worked at a company where the primary B2B website was like that. The login had been created in PHP by some folks who were really good at the relatively complex business domain, but thought "just throw a login screen up" was good enough security. For services where the customers spend hundreds of thousands of dollars. There were a handful of predetermined landing pages, depending on what "type" of user you were, and deep linking generally didn't work. OTH I see this more with SPAs, because there's not really a "page" to redirect back to, just a bunch of browser-local React state that shouldn't be trusted across authentication boundaries.