diff --git a/core/src/main/java/org/springframework/security/ui/TargetUrlResolverImpl.java b/core/src/main/java/org/springframework/security/ui/TargetUrlResolverImpl.java index 1a9ed6d7e5..f24372ec67 100644 --- a/core/src/main/java/org/springframework/security/ui/TargetUrlResolverImpl.java +++ b/core/src/main/java/org/springframework/security/ui/TargetUrlResolverImpl.java @@ -22,9 +22,11 @@ import javax.servlet.http.HttpServletRequest; import org.springframework.security.Authentication; import org.springframework.security.ui.savedrequest.SavedRequest; +import org.springframework.security.util.UrlUtils; import org.springframework.util.Assert; import org.springframework.util.StringUtils; + /** * Default implementation for {@link TargetUrlResolver} *

@@ -46,11 +48,10 @@ public class TargetUrlResolverImpl implements TargetUrlResolver { /** * If true, will only use SavedRequest to determine the target URL on successful * authentication if the request that caused the authentication request was a GET. - * It will return null for a POST/PUT request. - * In most cases it's meaningless to redirect to a URL generated by a POST/PUT request. - * Defaults to true. + * It will then return null for a POST/PUT request. + * Defaults to false. */ - private boolean justUseSavedRequestOnGet = true; + private boolean justUseSavedRequestOnGet = false; /* (non-Javadoc) * @see org.acegisecurity.ui.TargetUrlResolver#determineTargetUrl(org.acegisecurity.ui.savedrequest.SavedRequest, javax.servlet.http.HttpServletRequest, org.acegisecurity.Authentication) @@ -71,6 +72,9 @@ public class TargetUrlResolverImpl implements TargetUrlResolver { if (savedRequest != null) { if (!justUseSavedRequestOnGet || savedRequest.getMethod().equals("GET")) { targetUrl = savedRequest.getFullRequestUrl(); + } else { + // SavedRequest not used + UrlUtils.clearSavedRequest(currentRequest); } }