# Landing page on saml login

**URL:** https://meta.discourse.org/t/landing-page-on-saml-login/149377
**Category:** Support
**Created:** [26 april 2020 om 20:17 UTC](https://meta.discourse.org/t/landing-page-on-saml-login/149377 "2020-04-26T20:17:02Z")
**Posts on this page:** 1
**Showing post:** 14

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [30 april 2020 om 08:48 UTC](https://meta.discourse.org/t/landing-page-on-saml-login/149377/14 "2020-04-30T08:48:39Z")

</div>

> [@sbernhard](#):
>
> “security” (I know, its not really a big blocker). Cheap hacking scripts on the main URL (without the landing page) would fail hopefully as its required to press the login button first.

The automatic redirect should not introduce any security vulnerabilities. If you are aware of an exploit, please let us know via our disclosure program: [discourse/docs/SECURITY.md at main · discourse/discourse · GitHub](https://github.com/discourse/discourse/blob/master/docs/SECURITY.md)

> [@sbernhard](#):
>
> Would you accept a PR which adds a configuration option (default: new behavior)?

I don’t think we want to add more noise to the settings until we have some more users requesting this change.

You could override this in a plugin by patching this method:

> <https://github.com/discourse/discourse/blob/main/app/controllers/application_controller.rb#L697-L714>

So I think you would want to simplify the function right down to

```ruby
def redirect_to_login
  dont_cache_page
  cookies[:destination_url] = destination_url
  redirect_to path("/login")
end

```

---

_[View the full topic](https://meta.discourse.org/t/landing-page-on-saml-login/149377)._