Re: [keycloak-dev] html encoded url in form actions - bug or feature?
On 7/18/2018 2:37 AM, Felix Meißner wrote:
Hi all,
I just discovered that the action url of the login-form seems to get HTML
encoded and I woundered, if thats a bug or a feature.
It's a security feature.
We take advantage of FreeMarker's "escape by
default" feature. As you discovered, you can use ?no_esc to turn this off.
I'm kind of interested in why fetch() didn't work. The escaped version
should be valid as a URL.
In
https://github.com/keycloak/keycloak/blob/4.1.0.Final/themes/src/main/res...
you can see the following line:
<form id="kc-form-login" onsubmit="login.disabled = true; return
true;"
action="${url.loginAction}" method="post">
On my instance, this resolves to something similar to this:
<form id="kc-form-login" onsubmit="login.disabled = true; return
true;"
action="
https://xx.xx.xx.xx:8443/auth/realms/master/login-actions/authenticate?se...
method="post">
All "&" are encoded as &. This became an issue for me, when I tried
to
call the url via JavaScripts fetch method. With the same URL, I got a
sevrer error. When changing the URL to:
fetch("${url.loginAction?no_esc}", ...)
it finally worked.
Shouldn't all form-urls and href-urls not be escacped? What makes me wonder
is, that the same URL just works for regular post requests! For
documentation on escaping you can find more information here:
https://freemarker.apache.org/docs/dgui_quickstart_template.html#dgui_qui...
Greetings,
Felix