next url parameter is lost when going through 2fa about django-allauth-2fa HOT 6 CLOSED

FYI I went around this problem by overriding the default allauth login template with something like this

<form class="login" method="POST" action="{% url 'account_login' %}{% if redirect_field_value %}?{{ redirect_field_name }}={{ redirect_field_value }}{% endif %}">

so the form's action attribute takes next parameter into account. But maybe allauth-2fa could benefit from handling the next parameter with POST as well

from django-allauth-2fa.

Our login form looks something like this:

<form class="login" method="POST" action="{% url 'account_login' %}?{{ request.GET.urlencode }}">
  {% csrf_token %}
  {% bootstrap_form form layout='placeholder' %}
  {% if redirect_field_value %}
    <input type="hidden" name="{{ redirect_field_name }}" value="{{ redirect_field_value }}" />
  {% endif %}
  <button class="btn btn-info btn-block" type="submit">Log In</button>
</form>

(Note that this uses django-bootstrap3, but those just render to standard HTML fields.)

It looks like we're passing forward the next parameter by passing it in as part of request.GET.urlencode? Ideally this would work with the standard allauth template/form too!

Thanks for identifying the problem so succinctly, any idea how allauth handles this parameter that passed in / what the fix would be?

from django-allauth-2fa.

Hello,

So in the form you posted, I see that you pass the next parameter with GET and POST at the same time. GET with request.GET.urlencode and POST with the hidden input. And allauth-2fa only handles GET but it is fine in your case.

I looked into allauth source and after going several layers deep I found that it takes the POST parameter and defaults to the GET parameter if not found.

So I would say that the fix for allauth-2fa would be to add this field in the authenticate form and in the authenticate template, so it gets passed to allauth if provided. I might actually try to make a PR at some point

from django-allauth-2fa.

@ssimono A pull request would be appreciated! Let me know if you have any questions or need guidance. 👍

from django-allauth-2fa.

This can be a little tricky. The way we get to OTPAdapter.login() is through here: https://github.com/pennersr/django-allauth/blob/bd1d4a83b2490b7929310f9301ae8a1d4db7d54a/allauth/account/utils.py#L149-L150

The actual redirect_url, whether it's been obtained from POST, GET or static configuration, is not directly passed to the adapter... There are two ways to try to acquire it, both of which are dirty in their own ways:

1. Walk up the call stack using sys.getframe() or similar to find the bottom-most redirect_url string (it should be only one frame higher than the adapter)
2. Assume everyone uses next as their redirect URL parameter/POST field name and look them up in self.request in the adapter.

I'd personally prefer option 1.

from django-allauth-2fa.

I think I've written up a standards-compliant way of fixing this for GET and POST. Tests included. See accompanying PR. It uses the pre-existing methods for getting the success_url from the view class, after getting that from the request.

from django-allauth-2fa.