Due to a security test that my project has to pass, we need to get rid - or change the way it's done - of the login redirection:
/umbraco/login.aspx?redir=
It should be done in a way that the user cannot change the URL manually. Is it possible to change this via any parameter or configuration, or do we have to change the source code?
I doubt there's a config setting to change this within Umbraco. You could write a HTTPHandler that intercepts this request and responds appropriately, maybe by just stripping this parameter.
This would disable this functionality completely but it's not core functionality as it only allows the user to jump to a specific page in the back office.
Redir after login @ backoffice
Hey,
Due to a security test that my project has to pass, we need to get rid - or change the way it's done - of the login redirection:
It should be done in a way that the user cannot change the URL manually. Is it possible to change this via any parameter or configuration, or do we have to change the source code?
Thanks
I doubt there's a config setting to change this within Umbraco. You could write a HTTPHandler that intercepts this request and responds appropriately, maybe by just stripping this parameter.
This would disable this functionality completely but it's not core functionality as it only allows the user to jump to a specific page in the back office.
Chris
Thanks for your response Chris,
I opted for adding a piece of JS in login.aspx
Glad you found a solution. Remember though that someone can still use the 'redir' functionality if they disable javascript
is working on a reply...