Landing page on saml login

[david (David Taylor)]

@sbernhard

“security” (I know, its not really a big blocker). Cheap hacking scripts on the main URL (without the landing page) would fail hopefully as its required to press the login button first.

The automatic redirect should not introduce any security vulnerabilities. If you are aware of an exploit, please let us know via our disclosure program: discourse/docs/SECURITY.md at main · discourse/discourse · GitHub

@sbernhard

Would you accept a PR which adds a configuration option (default: new behavior)?

I don’t think we want to add more noise to the settings until we have some more users requesting this change.

You could override this in a plugin by patching this method:

discourse/discourse/blob/main/app/controllers/application_controller.rb#L697-L714

So I think you would want to simplify the function right down to

def redirect_to_login
  dont_cache_page
  cookies[:destination_url] = destination_url
  redirect_to path("/login")
end