Change the came_from to use a session variable

[Paul Everitt]

Per discussion in email, Tres will take this out of the URL to avoid promoting a phishing attack. Possibly to include a whitelist of patterns that the came_from must match.

[Tres Seaver (tseaver)]

We need to have the "business center" app developers tell us whether they are still using the karl.external_link_ticket authentication machinery, which would be broken by this change.

[Tres Seaver (tseaver)]

Nat, can you please find out from Ajo (or somebody else) whether the business center apps still rely on KARL for authentication?

[Nat Katin-Borland (nborland)]

Hey Tres,

I'm working on getting this confirmation from Ajo and I'll pass along his answer as soon as I get it.

-Nat

[Paul Everitt (paul-agendaless)]

Based on analysis from OSF, they do NOT have a need to redirect (came_from) to any URL outside of KARL. So we don't need a configurable whitelist.

[Chris Rossi (chris-archimedeanco)]

Deployed on karldev: chrisrossi-1135630-came-from

[Paul Everitt (paul-agendaless)]

Nat reviewed, said it is ready whenever we want to merge.

[Tres Seaver (tseaver)]

This branch is now deployed to karlstaging (via the 'm125' integration branch).

[Duncan Booth (kupuguy)]

Unfortunately this fix breaks links stored in Microsoft Office.

If you try to follow a link to a Karl system from a Microsoft Office document, you get the following sequence of events:

Microsoft Office tries to retrieve the URL, but because Office is not logged in even if the browser is it gets a 302 response redirecting it to login.html (with the session cookie set). Microsoft Office then fetches the login.html page and gets a 200 response. It determines the content-type is not a Microsoft Office document type so it sends the login.html URL to the user's default browser.

The user's browser fetches the login page, performs any authentication necessary, but has its own session so there is no redirect to the source page.