This question is a question about login flows for web-apps in general. I'm most interested in answers that optimize for usability and performance while maintaining security.
What is the most appropriate way to handle unauthenticated requests to bookmarked URLs?
To demonstrate the problem, here are some routes and respective behaviors for an example application:
GET /login -> Display the authentication form
POST /processLogin -> process the username and password,
if unauthentic...re-render the login form;
otherwise...display the default page
GET /secret -> if authenticated...display the secret resource;
otherwise...display a login form
POST /secret -> if authenticated...perform a desirable, but potentially
non-idempotent action on the secret
resource
otherwise...display a login form
Option 1: Display login screen, redirect to desired page
- User clicks bookmark
- GET /secret -> 200, surreptitiously display login form with hidden field path="/secret"
- POST /processLogin -> 302 to /secret (value of path parameter)
- GET /secret -> 200, secret resource displayed
Analysis: Hopefully, your client is a modern browser, non-compliant with HTTP, such that it performs a GET after a 302'd POST. This applies across the board. Should I be worried?
Option 2: Redirect to login screen, redirect to desired page
- User clicks bookmark
- GET /secret -> 302 to /login
- GET /login via redirect -> 200, login form displayed with hidden field path="/secret"
- POST /processLogin -> 302 to /secret
- GET /secret -> 200, secret resource displayed
Analysis: Same problems as above. Added problem that the URL displayed by the browser during login changes, which is confusing to the user and breaks bookmarking, link sharing, etc.
Option 3: Display login screen, display desired page
- User clicks bookmark
- GET /secret -> 200, surreptitiously display login form with action="/secret"
- POST /secret -> 200, secret resource displayed
Analysis: Sadly, the refresh button is now also broken: refresh will cause the user agent to re-POST with a warning, instead of re-GETing /secret. They user gets a warning, but if they ignore it, something bad happens.
On the bright side, you minimize roundtrips with this technique.
Option 4: Redirect to login screen, display desired page
- User clicks bookmark
- GET /secret -> 302 to /processLogin
- GET /processLogin via redirect -> 200, login form displayed with action="/secret"
- POST /secret -> 302 to /secret
- GET /secret -> 200, secret resource displayed
Analysis: Same problems as options 2+4.
Option 5: ???
Is there another technique I'm missing?
In general, which of these techniques would you recommend?
See Also
What is correct HTTP status code when redirecting to a login page? What kind of HTTP redirect for logins? HTTP response with redirect, but without roundtrip?
hidden field path="/secret"
, it should not be in the form on the client side. If the client leave his computer at that point, a hacker can see which page he was trying to access. I think that information should stay on the server in a session.