Reworded the article about form login redirects #8192

javiereguiluz · 2017-07-19T08:32:47Z

Now that form login redirects have been fully fixed (see symfony/symfony#23580) I thought about updating this article, specially its structure.

All changes are simple rewordings, except this one: previously, the article said that you can use a Symfony route name as the value of the _target_path parameter in the query string or the hidden form field. But if you check the code of this feature, it looks like you can't because we use the value of that parameter "as is" to redirect, so it must be a relative/absolute URL, right?

protected function determineTargetUrl(Request $request)
{
    if ($this->options['always_use_default_target_path']) {
        return $this->options['default_target_path'];
    }

    // We redirect directly to the value of the parameter, so it can't be a route name, right ????
    if ($targetUrl = $request->get($this->options['target_path_parameter'], null, true)) {
        return $targetUrl;
    }

    // ...
}

yceruto · 2017-07-19T13:43:40Z

Please, could you take account this comment symfony/symfony#17529 (comment) in this PR? thanks.

yceruto · 2017-07-19T13:58:52Z

See @dmaicher's comment which also explains the only use case of this option:

So it only works for use cases where the form POST comes from a different page than /login
Maybe its meant to be used if you have the login form embedded in the header of your page or something. So once you logged in you get redirected back to the page where the POST came from.

javiereguiluz · 2017-07-20T06:38:58Z

@yceruto thanks for letting me know this. I've updated the article. Cheers!

xabbuh · 2017-07-21T15:05:23Z

security/form_login.rst

+Using a :doc:`form login </security/form_login_setup>` for authentication is a
+common, and flexible, method for handling authentication in Symfony. This
+article explains how to customize the URL which the user is redirected to after
+a successful or failure login. Check out the full


"[...] or failed login."?

xabbuh · 2017-07-21T15:05:39Z

security/form_login.rst

+article explains how to customize the URL which the user is redirected to after
+a successful or failure login. Check out the full
+:doc:`form login configuration reference </reference/configuration/security>` to
+learn about the rest of possible customizations.


[...] of the possile customization options.

xabbuh · 2017-07-21T15:06:26Z

security/form_login.rst

-in several ways.
+By default, the form will redirect to the URL the user requested (i.e. the URL
+which triggered the login form being shown). For example, if the user requested
+``http://www.example.com/admin/post/18/edit``, then after they successfully log


[...] they have successfully logged in, [...]

xabbuh · 2017-07-21T15:08:47Z

security/form_login.rst

-``default_security_target`` route use the following config:
+Define the ``default_security_target`` option to change the page where the user
+is redirected to if no previous page was stored in the session. The value can be
+ relative/absolute URL or a Symfony route name:


[...] can be a relative/absolute [...]

the leading whitespace must be removed by the way (see the build failure)

xabbuh · 2017-07-21T15:10:08Z

security/form_login.rst

+
+    .. code-block:: html+twig
+
+        {# src/AppBundle/Resources/views/Security/login.html.twig #}


{# app/Resources/views/security/login.html.twig #}

xabbuh · 2017-07-21T15:10:34Z

security/form_login.rst

+
+    .. code-block:: html+php
+
+        <!-- src/AppBundle/Resources/views/Security/login.html.php -->


xabbuh · 2017-07-21T15:11:24Z

security/form_login.rst

-~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. note::
+
+    The referrer URL is only used when is different from the URL generated by


[...] when it is [...]

xabbuh · 2017-07-21T15:11:35Z

security/form_login.rst

+.. note::
+
+    The referrer URL is only used when is different from the URL generated by
+    the ``login_path`` route, to avoid a redirection loop.


the comma should be removed

xabbuh · 2017-07-21T15:12:14Z

security/form_login.rst

-and ``_failure_path`` for login errors:
+.. code-block:: text
+
+    http://example.com/some/path?_failure_path=/forgot-password

 .. configuration-block::

    .. code-block:: html+twig

        {# src/AppBundle/Resources/views/Security/login.html.twig #}


{# app/Resources/views/security/login.html.twig #}

xabbuh · 2017-07-21T15:12:43Z

security/form_login.rst


+            <input type="hidden" name="_failure_path" value="{{ path('forgot-password') }}" />


forgot_password

xabbuh · 2017-07-21T15:12:54Z

security/form_login.rst


+            <input type="hidden" name="_failure_path" value="<?php echo $view['router']->generate('forgot-password') ?>" />


forgot_password

xabbuh · 2017-07-21T15:13:03Z

security/form_login.rst

-
-            <input type="hidden" name="_target_path" value="account" />
-            <input type="hidden" name="_failure_path" value="login" />
+            // ...


xabbuh · 2017-07-21T15:13:17Z

security/form_login.rst


+            <input type="hidden" name="_failure_path" value="{{ path('forgot-password') }}" />
            <input type="submit" name="login" />
        </form>

    .. code-block:: html+php

        <!-- src/AppBundle/Resources/views/Security/login.html.php -->


xabbuh · 2017-07-21T15:14:03Z

security/form_login.rst

+
+    .. code-block:: html+twig
+
+        {# src/AppBundle/Resources/views/Security/login.html.twig #}


{# app/Resources/views/security/login.html.twig #}

xabbuh · 2017-07-21T15:14:13Z

security/form_login.rst

+
+        <!-- src/AppBundle/Resources/views/Security/login.html.php -->
+        <form action="<?php echo $view['router']->generate('login') ?>" method="post">
+            // ...


xabbuh · 2017-07-21T15:14:23Z

security/form_login.rst

+
+    .. code-block:: html+php
+
+        <!-- src/AppBundle/Resources/views/Security/login.html.php -->


xabbuh · 2017-07-21T15:14:43Z

security/form_login.rst

+            {# ... #}
+
+            <input type="hidden" name="go_to" value="{{ path('dashboard') }}" />
+            <input type="hidden" name="back_to" value="{{ path('forgot-password') }}" />


forgot_password

xabbuh · 2017-07-21T15:14:49Z

security/form_login.rst

+            // ...
+
+            <input type="hidden" name="go_to" value="<?php echo $view['router']->generate('dashboard') ?>" />
+            <input type="hidden" name="back_to" value="<?php echo $view['router']->generate('forgot-password') ?>" />


forgot_password

javiereguiluz · 2017-07-21T15:21:59Z

@xabbuh thank you for the time you dedicated to review this. As usual, a great review! Thanks.

xabbuh · 2017-07-21T15:28:52Z

Thank you Javier.

…uiluz) This PR was squashed before being merged into the 2.7 branch (closes #8192). Discussion ---------- Reworded the article about form login redirects Now that form login redirects have been fully fixed (see symfony/symfony#23580) I thought about updating this article, specially its structure. All changes are simple rewordings, except this one: previously, the article said that you can use a Symfony route name as the value of the `_target_path` parameter in the query string or the hidden form field. But if you check the code of this feature, it looks like you can't because we use the value of that parameter "as is" to redirect, so it must be a relative/absolute URL, right? ```php protected function determineTargetUrl(Request $request) { if ($this->options['always_use_default_target_path']) { return $this->options['default_target_path']; } // We redirect directly to the value of the parameter, so it can't be a route name, right ???? if ($targetUrl = $request->get($this->options['target_path_parameter'], null, true)) { return $targetUrl; } // ... } ``` Commits ------- 5015723 Reworded the article about form login redirects

* 2.8: (37 commits) [#8192] use path() in PHP templates Reworded the article about form login redirects Explained the edge-case where the use_referer option doesn't work [#7572] fix wording [#7585] remove trailing whitespaces [#7585] minor rewording Fixed a typo Fixed a typo Update parent_services for tip consistency [#7685] use the method role Minor change Updating doc to specify priority of default normalizer [#7767] remove trailing space [#7767] replace "options" with "entry_options" [#7767] minor rewording [#8047] add inline code comment Fixed the issue in a different way Jquery datePicker syntax update [#8104] minor rewording Add more precision about automatic provider assignation ...

* 3.2: (38 commits) [#8192] use path() in PHP templates Reworded the article about form login redirects Explained the edge-case where the use_referer option doesn't work [#7572] fix wording [#7585] remove trailing whitespaces [#7585] minor rewording Fixed a typo Fixed a typo Update parent_services for tip consistency [#7685] use the method role Minor change Updating doc to specify priority of default normalizer [#7767] remove trailing space [#7767] replace "options" with "entry_options" [#7767] minor rewording [#8047] add inline code comment Fixed the issue in a different way Jquery datePicker syntax update Fix framework instantiation in event-dispatcher [#8104] minor rewording ...

* 3.3: (46 commits) [#8192] use path() in PHP templates Reworded the article about form login redirects Update Flex documentation with latest structure Explained the edge-case where the use_referer option doesn't work [#7572] fix wording [#7585] remove trailing whitespaces [#7585] minor rewording Fixed a typo Fixed a typo Update parent_services for tip consistency [#7685] use the method role Minor change Updating doc to specify priority of default normalizer [#7767] remove trailing space [#7767] replace "options" with "entry_options" [#7767] minor rewording [#8047] add inline code comment Fixed the issue in a different way Jquery datePicker syntax update Fix framework instantiation in event-dispatcher ...

* 3.4: (48 commits) [#8192] use path() in PHP templates Reworded the article about form login redirects Update Flex documentation with latest structure Explained the edge-case where the use_referer option doesn't work [#7572] fix wording [#7585] remove trailing whitespaces [#7585] minor rewording Fixed a typo Fixed a typo Update parent_services for tip consistency [#7685] use the method role Minor change Updating doc to specify priority of default normalizer [#7767] remove trailing space [#7767] replace "options" with "entry_options" [#7767] minor rewording [#8047] add inline code comment Fixed the issue in a different way Jquery datePicker syntax update Fix framework instantiation in event-dispatcher ...

Reworded the article about form login redirects

3e1edff

carsonbot added the Status: Needs Review label Jul 19, 2017

Added some help notes

e4ee518

javiereguiluz mentioned this pull request Jul 20, 2017

[Security] form login use_referer option not work. symfony/symfony#17529

Closed

Removed a note that has been moved to the security config reference

5652ab0

xabbuh added this to the 2.7 milestone Jul 21, 2017

xabbuh reviewed Jul 21, 2017

View reviewed changes

security/form_login.rst Outdated

<input type="hidden" name="_failure_path" value="{{ path('forgot-password') }}" />

Copy link

Member

xabbuh Jul 21, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

forgot_password

xabbuh reviewed Jul 21, 2017

View reviewed changes

Fixed lots of issues

5d75e8b

xabbuh added a commit that referenced this pull request Jul 21, 2017

[#8192] use path() in PHP templates

4e58220

xabbuh closed this Jul 21, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Reworded the article about form login redirects #8192

Reworded the article about form login redirects #8192

javiereguiluz commented Jul 19, 2017

yceruto commented Jul 19, 2017 •

edited

Loading

yceruto commented Jul 19, 2017

javiereguiluz commented Jul 20, 2017

xabbuh Jul 21, 2017

xabbuh Jul 21, 2017

xabbuh Jul 21, 2017

xabbuh Jul 21, 2017

xabbuh Jul 21, 2017

xabbuh Jul 21, 2017

xabbuh Jul 21, 2017

xabbuh Jul 21, 2017

xabbuh Jul 21, 2017

xabbuh Jul 21, 2017 •

edited

Loading

xabbuh Jul 21, 2017

xabbuh Jul 21, 2017

xabbuh Jul 21, 2017

xabbuh Jul 21, 2017

xabbuh Jul 21, 2017

xabbuh Jul 21, 2017

xabbuh Jul 21, 2017

xabbuh Jul 21, 2017

xabbuh Jul 21, 2017

javiereguiluz commented Jul 21, 2017

xabbuh commented Jul 21, 2017


		.. code-block:: html+twig

		{# src/AppBundle/Resources/views/Security/login.html.twig #}


		.. code-block:: html+php

		<!-- src/AppBundle/Resources/views/Security/login.html.php -->


		<input type="hidden" name="_failure_path" value="{{ path('forgot-password') }}" />

Reworded the article about form login redirects #8192

Reworded the article about form login redirects #8192

Conversation

javiereguiluz commented Jul 19, 2017

yceruto commented Jul 19, 2017 • edited Loading

yceruto commented Jul 19, 2017

javiereguiluz commented Jul 20, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

xabbuh Jul 21, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

javiereguiluz commented Jul 21, 2017

xabbuh commented Jul 21, 2017

yceruto commented Jul 19, 2017 •

edited

Loading

xabbuh Jul 21, 2017 •

edited

Loading