1   package com.atlassian.seraph.config;
2   
3   import com.atlassian.seraph.Initable;
4   
5   import javax.servlet.http.HttpServletRequest;
6   
7   /**
8    * This interface is included to allow fine-grained control over what URLs Seraph will allow you to redirect to.
9    * <p/>
10   * Upon successful login, Seraph will redirect the user to a URL configured in the HTTP Session or as a request parameter.
11   * In order to hinder potential phishing attacks, by default Seraph will only allow you to redirect to a URL in the same
12   * context as the incoming request.
13   * Applications can change this behaviour by configuring the default RedirectPolicy, or providing a custom one.
14   * <p/>
15   * Note that applications can also take advantage of Seraph redirect checking for internal redirects.
16   * To do so, they would get hold of the RedirectPolicy by calling {@link com.atlassian.seraph.config.SecurityConfig#getRedirectPolicy}  
17   *
18   * @since v0.38.3
19   */
20  public interface RedirectPolicy extends Initable
21  {
22      /**
23       * Returns <code>true</code> if we are allowed to redirect to the given URL from the given HTTP request.
24       * This is intended to stop malicious users from constructing URL's that would log you in to JIRA, then redirect you some where else.
25       * See http://jira.atlassian.com/browse/SER-128
26       *
27       * @param redirectUrl The URL we are proposing to redirect to.
28       * @param request The incoming HttpServletRequest.
29       * @return <code>true</code> if we are allowed to redirect to the given URL from the given HTTP request.
30       */
31      public boolean allowedRedirectDestination(String redirectUrl, HttpServletRequest request);
32  }