responders icon indicating copy to clipboard operation
responders copied to clipboard

`location` compatibility with `allow_other_host`

Open boardfish opened this issue 2 years ago • 2 comments

When raise_on_open_redirects is enabled in Rails config, redirect_to now raises UnsafeRedirectError in case the host of the redirect location does not match that of the current request. It's ordinarily possible when using redirect_to to specify allow_other_host: true to prevent this error from being raised in situations where UnsafeRedirectError did not need to be raised.

However, if the location param is used, it isn't possible to do this - the redirect path is expected as a single variable.

This does not work:

respond_with @thing, location: redirect_path, allow_other_host: true

I also attempted this:

respond_with @thing do |format|
  format.html { redirect_to redirect_path, allow_other_host: true }
end

But this causes a regression in that I'm reliant on respond_with's handling of an invalid record, particularly the error flash.

I'm happy to look into a fix for this myself, but I could perhaps do with some guidance. I think all we might need is to pluck allow_other_host from options and pass this into this call, but we may have room to afford ourselves something more flexible than that.

boardfish avatar Oct 28 '22 16:10 boardfish