Intended URL redirect + default redirect after login?

Question

When a user tries to access our website via a link (for instance going to www.website.com/privatepage) they are redirected to a login page. Once they login, we want to redirect them to that intended URL - how do you do this?

Also we have a use case where a user logs in from the homepage, or goes directly to the login page with no intended URL - in this case we'd like to redirect them to a default page.

Can anyone help me figure this out?

Answer 1

in your login page:

if you go to www.example.com/private_page

using CodeIgniter (on private page)

// if user is not logged in...
$_SESSION['redirect'] = $this->uri->segment(1);
redirect('login');

on login page

// successfully logged in..
if (isset($_SESSION['redirect'])) {
    redirect($_SESSION['redirect']);
} else {
    // redirect to default page
}

Answer 2

It might be a good idea to have a whitelist of accepted urls when redirecting in this fashion - otherwise, an attacker could send someone a link like example.com/login?attacker.com/fake_examplecom and the user will be redirected to the attacker's site while thinking they have just logged in to your site. The original url pointed to your site, so it looks trustworthy. There's a lot of nasty things that can be done with this, as you can imagine.