|
When redirecting from the https CAS application back to an http service after authenticating successfully, IE6 presents the user with a security dialog saying "you are about to be redirected to a connection that is not secure, do you really want to do this?". We can avoid this by using javascript to perform the redirection in the client browser, instead of a server side redirect. This approach works fine for web pages, but does not work for protected image content, which will not execute the returned javascript, so we revert to a serverside redirect for this type of content. 1. Create WEB-INF/view/jsp/default/ui/redirect.jsp to perform the redirection using javascript <%@page import="org.jasig.cas.authentication.principal.WebApplicationService" %> <%@page import="org.jasig.cas.web.support.WebUtils" %> <%@page import="java.net.URL" %> <% WebApplicationService service = (WebApplicationService) request.getAttribute("service"); String ticket = (String) request.getAttribute("serviceTicketId"); String redirectURL = service.getResponse(ticket).getUrl(); boolean serverSideRedirect = false; // if redirect is for an image, js or css file URL url = new URL(redirectURL); String path = url.getPath(); int dotPos = path.lastIndexOf("."); // returns -1 if not found if( dotPos != -1 ) { String ext = path.substring(dotPos).toLowerCase(); serverSideRedirect = ".gif".equals(ext) || ".jpg".equals(ext) || ".png".equals(ext) || ".js".equals(ext) || ".css".equals(ext); } if( serverSideRedirect ) { // Serverside redirect using HTTP 302 response.sendRedirect(redirectURL); } else { // Client side redirect using javascript %> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head> <script type="text/javascript" language="javascript"> <!-- window.location.replace ("<%=redirectURL%>"); --> </script> <title>Redirect</title> </head> <body></body> </html> <% } %> 2. Make a redirect view available to CAS by adding it to WEB-INF/classes/default_view.properties ### Redirect view (logged in, javascript redirect to service)
redirectView.(class)=org.springframework.web.servlet.view.JstlView
redirectView.url=/WEB-INF/view/jsp/default/ui/redirect.jsp
3. Modify WEB-INF/login-webflow.xml to make the redirect end state use the new view <end-state id="redirect" view="redirectView" /> |