13

This question is a question about login flows for web-apps in general. I'm most interested in answers that optimize for usability and performance while maintaining security.

What is the most appropriate way to handle unauthenticated requests to bookmarked URLs?

To demonstrate the problem, here are some routes and respective behaviors for an example application:

GET /login         -> Display the authentication form
POST /processLogin -> process the username and password, 
                            if unauthentic...re-render the login form; 
                            otherwise...display the default page
GET /secret         -> if authenticated...display the secret resource;
                       otherwise...display a login form
POST /secret        -> if authenticated...perform a desirable, but potentially 
                                          non-idempotent action on the secret 
                                          resource
                       otherwise...display a login form

Option 1: Display login screen, redirect to desired page

  1. User clicks bookmark
  2. GET /secret -> 200, surreptitiously display login form with hidden field path="/secret"
  3. POST /processLogin -> 302 to /secret (value of path parameter)
  4. GET /secret -> 200, secret resource displayed

Analysis: Hopefully, your client is a modern browser, non-compliant with HTTP, such that it performs a GET after a 302'd POST. This applies across the board. Should I be worried?

Option 2: Redirect to login screen, redirect to desired page

  1. User clicks bookmark
  2. GET /secret -> 302 to /login
  3. GET /login via redirect -> 200, login form displayed with hidden field path="/secret"
  4. POST /processLogin -> 302 to /secret
  5. GET /secret -> 200, secret resource displayed

Analysis: Same problems as above. Added problem that the URL displayed by the browser during login changes, which is confusing to the user and breaks bookmarking, link sharing, etc.

Option 3: Display login screen, display desired page

  1. User clicks bookmark
  2. GET /secret -> 200, surreptitiously display login form with action="/secret"
  3. POST /secret -> 200, secret resource displayed

Analysis: Sadly, the refresh button is now also broken: refresh will cause the user agent to re-POST with a warning, instead of re-GETing /secret. They user gets a warning, but if they ignore it, something bad happens.

On the bright side, you minimize roundtrips with this technique.

Option 4: Redirect to login screen, display desired page

  1. User clicks bookmark
  2. GET /secret -> 302 to /processLogin
  3. GET /processLogin via redirect -> 200, login form displayed with action="/secret"
  4. POST /secret -> 302 to /secret
  5. GET /secret -> 200, secret resource displayed

Analysis: Same problems as options 2+4.

Option 5: ???

Is there another technique I'm missing?

In general, which of these techniques would you recommend?

See Also

What is correct HTTP status code when redirecting to a login page? What kind of HTTP redirect for logins? HTTP response with redirect, but without roundtrip?

2
  • 1
    Here's another option: Use an ajax request to replace the logon page with the real page without a page refresh :) Mar 7, 2013 at 22:04
  • One note about your hidden field path="/secret", it should not be in the form on the client side. If the client leave his computer at that point, a hacker can see which page he was trying to access. I think that information should stay on the server in a session. Dec 7, 2013 at 21:52

5 Answers 5

6
+100

Option 1 & 3 are not following the HTTP RFC as "surreptitiously display login form" contradicts 200 GET response, where "an entity corresponding to the requested resource is sent in the response" is expected.

Option 2 is OK. All modern browsers support 302 on POST and many REST-based frameworks (like RoR) actively use it. Alternatively in "302 to /login" you can already create the session (cookie) and store the URL in session, to avoid passing the original URL in GET parameters. From usability standpoint, you can have an appropriate message on login page too (I think the URL mismatch is irrelevant here - you can't let the user see the content anyway).

Option 4: when you POST to /secret, HTTP RFC expects you to "accept the entity enclosed in the request as a new subordinate of the resource identified by the Request-URI in the Request-Line", but all you are doing is logging in and not creating anything new under /secret.

So following HTTP RFC, your best choice is Option 2. Actually Option 2 is also in line with POST->Redirect->GET design pattern, which helps to address the issue of unpredictability in bookmarking URLs to POST'ed resources.

2
  • Although I agree that a PUT has the intend to modify a page, a POST is not exactly so. I've seen countless login forms that send the POST to themselves so on failure you just redisplay that one page. Also option 2 sends to /processLogin which does not change that "resource page." The registration page changes something on the site in this paradigm and it probably has a "wrong" URI too because in that case you are not on the "Edit User" page (And the "reset password" form...) Mar 14, 2013 at 21:09
  • If you follow HTTP RFC word for word, then client should call POST /processLogin, which creates a session object as "a new subordinate of the resource" (say /processLogin/<session ID>). A word of caution on PUT and other methods: HTML standard (even HTML5) has no support for form methods rather than GET and POST. So to complete the example, on logout HTTP RFC client should call DELETE /processLogin/<session ID>, which can be easily done in custom clients and AJAX, but won't work in forms without some kind of a workaround (like passing overriding "_method" hidden values). Mar 15, 2013 at 4:13
3

My $.02: I recently implemented using option 2 (although I stored /secret in a session, not in the login form as a hidden field).

I don't entirely share your concerns:

Added problem that the URL displayed by the browser during login changes, which is confusing to the user and breaks bookmarking, link sharing, etc.

Redirecting to /login, and the subsequent change of URL, tells the user that before they can continue there's something else that needs to be done first: logging in.

Since a login page will look entirely different from the 'target page', I don't see how that will confuse people into bookmarking and/or link sharing the login page instead of the target page (since the login page won't contain the information they want to bookmark/share anyway).

And if you're worried about 302's breaking the standard (although every single browser I know will happily break it), consider using 303's instead.

1

Note that mickeyreiss is correct, using AJAX Option 3 works without the drawback of the broken back button. However, it means the user has to have JavaScript enabled. This being said, if you program your form properly, you can detect whether JS is present, if not use Option 1.

Note that the 302 response is fine, however, you may have problems with caches. You have to make sure that nothing gets cached if you want to show 2 completely different pages/forms on for the same URI. (/secret showing the login and then the actual secret.)

1
  • In my case, JavaScript is required to login for other reasons. In general, you are right; you should always try to implement a gracefully degrading solution. Mar 14, 2013 at 20:15
1

I almost always use option #2, simply because the content returned by a URL is consistent. While today's secrets are hidden behind a login, tomorrow you may want to open it up or display mixed public/secret depending on authentication at the same URL. In that case, option #2 will be most like what Google would expect. Any content bait and switch is looked down on by Google and in the extreme case, all of your pages would have duplicate page content (ie. login form).

2
  • Protected pages should be marked as "noindex" which tells Google (and other non-broken search engines) that you do not want that page in their index. They will still read it and cache it, etc. but the result is that you don't get duplicates. Mar 14, 2013 at 21:02
  • To be sure. However, if he's using one of the bait and switch log in models, it will be tiresome to disentangle the log in process from the newly index-able pages down the road.
    – kilsek
    Mar 15, 2013 at 13:26
0

I would choose the option using AJAX:

  1. login page and hide the content
  2. the user enters the login and the password.
  3. Authentication is done in the server side.
  4. The server returns a result
  5. if successful use location.href to set the page you would like to go to, or else you can output a message saying the login is not valid.
  6. In your server you will be testing on a _SESSION variable, if not set redirect to the login page..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.