fix: Use HTTP 302 instead of 301 Redirections - Meeds-io/MIPs#134

Meeds-io · Jul 23, 2024 · 2af0c42 · 2af0c42
1 parent 23eac36
commit 2af0c42
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/webui/src/main/java/io/meeds/portal/permlink/web/PermanentLinkRequestHandler.java b/webui/src/main/java/io/meeds/portal/permlink/web/PermanentLinkRequestHandler.java
@@ -65,8 +65,10 @@ public boolean execute(ControllerContext context) throws Exception {
     try {
       String directAccessUrl = getPermanentLinkService().getDirectAccessUrl(requestPath, currentIdentity);
       HttpServletResponse res = context.getResponse();
-      res.setStatus(HttpServletResponse.SC_MOVED_PERMANENTLY);
-      res.setHeader("Location", directAccessUrl);
+      // Use HTTP 302 response instead of 301 to not
+      // allow to cache the redirect directive in routers
+      // and user browsers to secure effective URL
+      res.sendRedirect(directAccessUrl);
     } catch (IllegalAccessException e) {
       if (currentIdentity == null || StringUtils.equals(IdentityConstants.ANONIM, currentIdentity.getUserId())) {
         String loginPath = getAuthenticationUrl(context.getRequest().getRequestURI());