-
Type:
Bug
-
Resolution: Low Engagement
-
Priority:
Low
-
None
-
Affects Version/s: 7.1.10, 7.2.0, 7.2.1
-
Component/s: Java API
-
7.01
-
Severity 2 - Major
-
0
Trying to do a javax.servlet.http.HttpServletResponse#sendRedirect with an absolute url (which is perfecty valid according to the spec), might cause JIRA to try to forward to that redirect instead.
This seems to be caused by com.atlassian.jira.web.JiraForwardAuthorizer chosing the url to be forwarded rather than redirected (which is fine-ish), and com.atlassian.web.servlet.plugin.request.RedirectInterceptingResponse#resolveLocation not handling absolute urls at all, deciding to forward to the absolute url.
Actual result
The result is a 404. We've hit it when doing redirection after a redirect.
Expected result
Normal re-direct happens.
Workaround
- Include setting the magic SEND_REDIRECT_ONGOING attribute
- avoid doing absolute redirects.