Use Javascript Redirection

When redirecting from the https CAS application back to an http service after authenticating successfully, IE6 presents the user with a security dialog saying "you are about to be redirected to a connection that is not secure, do you really want to do this?". We can avoid this by using javascript to perform the redirection in the client browser, instead of a server side redirect. This approach works fine for web pages, but does not work for protected image content, which will not execute the returned javascript, so we revert to a serverside redirect for this type of content.

1. Create WEB-INF/view/jsp/default/ui/redirect.jsp to perform the redirection using javascript


<%@page import="org.jasig.cas.authentication.principal.WebApplicationService" %>
<%@page import="org.jasig.cas.web.support.WebUtils" %>
<%@page import="java.net.URL" %>
<%
WebApplicationService service = (WebApplicationService) request.getAttribute("service");
String ticket  = (String) request.getAttribute("serviceTicketId");
String redirectURL = service.getResponse(ticket).getUrl();
boolean serverSideRedirect = false;
// if redirect is for an image, js or css file
URL url = new URL(redirectURL);
String path = url.getPath();
int dotPos = path.lastIndexOf("."); // returns -1 if not found
if( dotPos != -1 )
{
    String ext = path.substring(dotPos).toLowerCase();
    serverSideRedirect = ".gif".equals(ext) || ".jpg".equals(ext) || ".png".equals(ext) || ".js".equals(ext) || ".css".equals(ext);
}
if( serverSideRedirect )
{
    // Serverside redirect using HTTP 302
    response.sendRedirect(redirectURL);
}
else
{
    // Client side redirect using javascript
%>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
  <head>
    <script type="text/javascript" language="javascript">
      <!--
        window.location.replace ("<%=redirectURL%>");
      -->
    </script>
    <title>Redirect</title>
  </head>
  <body></body>
</html>
<%
}
%>

2. Make a redirect view available to CAS by adding it to WEB-INF/classes/default_view.properties


### Redirect view (logged in, javascript redirect to service)
redirectView.(class)=org.springframework.web.servlet.view.JstlView
redirectView.url=/WEB-INF/view/jsp/default/ui/redirect.jsp

3. Modify WEB-INF/login-webflow.xml to make the redirect end state use the new view


<end-state id="redirect" view="redirectView" />