@Some Guy - yea I know. That's the problem with building your own software... you have to implement everythign yourself. I'm working on a spam filter for comments, just don't have the time right now.
Yo
A word of caution. Using params like this leaves you open for a potential cross-site-scripting attack. An attacker can look at the source code to see your URL that sends the user to the auth page. They can take that URL, change the spring-security-redirect param to some destination they want, and now the user will go through the login normally, but end up on a bogus page. A hacker can send the constructed link in an email so that they immediately go to the legitimate login page on your site and then to the hacked dest page, or they can create another page that looks like your site, uses your auth, then sends the user to a bogus destination.
@JusJammin - thanks for mentioning that. I actually use the same method in my own apps. @Crewman you're right, but anyone using Spring Security could experience this issue since I don't even need to use a form to make this happen, unless you configure Spring Security to use a more pessimistic approach when redirecting. To learn more about what's actually going on under the covers, I suggest reading the javadoc and looking at the source code for org.springframework.security.web.authentication.AbstractAuthenticationTargetUrlRequestHandler
and org.springframework.security.web.DefaultRedirectStrategy
Great post. Just want to add that for this to work in both development and production you should have to remove the context path from the request uri, like so:
<g:link controller="login" action="auth" params="['spring-security-redirect': request.forwardURI - request.contextPath]">
