title: Pass Information with URL redirection
body: <p>We are working on an existing application where web services (tomcat) as well as UI (nginx) applications are hosted on separate containers. One of the service application is used for sending login request (SAML request) to identity provider (ping). Here are the steps for user login to the system:</p>
  
  <ul>
  <li>User loads the application (domain URL: <a href="https://ui.domain.com" rel="nofollow noreferrer">https://ui.domain.com</a>), it loads the UI where it checks for logged in user (JWT token string generated for user/role) on local storage and when not found, it redirects to ping (IDP) for authentication.</li>
  <li>Once authenticated with ping, it calls the spring controller which is configured for the success URL on service application (<a href="https://api.domain.com/auth-service/auth" rel="nofollow noreferrer">https://api.domain.com/auth-service/auth</a>). </li>
  <li>This controller service (/auth), gets the SAML response sent by ping and processes it further to get user details and generates the JWT token for the user and redirects the user to UI (<a href="https://ui.domain.com" rel="nofollow noreferrer">https://ui.domain.com</a>). </li>
  </ul>
  
  <p>Problem Statement:</p>
  
  <p>To pass the token to UI, the JWT token string is added to URL by using 
     <code>redirectAttributes.addAttribute(“auth-token”, token);</code></p>
  
  <p>With the above, it shows up in the address bar like: <a href="https://ui.domain.com/?auth-token=" rel="nofollow noreferrer">https://ui.domain.com/?auth-token=</a></p>
  
  <p>This has raised a concern with respect to security as the token is displayed on address bar and exposed which can be decoded to get user information.</p>
  
  <p>Current Approach (tried):</p>
  
  <ul>
  <li><p>Before redirection from controller to UI, tried to set cookie</p>
  
  <pre><code>Cookie cookie = new Cookie(“auth-token”, token);
  cookie.setMaxAge(-1);
  cookie.setPath(“https://ui.domain.com”);
  response.addCookie(cookie);
  </code></pre></li>
  </ul>
  
  <p>However we couldn’t find the cookie from UI.</p>
  
  <ul>
  <li><p>We tried to set it to response header too.</p>
  
  <p><code>response.addHeader(“auth-token”, token);</code></p></li>
  </ul>
  
  <p>Since it is a redirection, the adding to response doesn’t help.</p>
  
  <p>Further trials:</p>
  
  <p>We are also putting a thought about changing the approach of authentication controls where after ping authentication is done, the success URL can be replaced with UI url rather than service URL, i.e. </p>
  
  <p>Current: <code>saml.sso.default-success-url= https://api.domain.com/auth-service/auth</code></p>
  
  <p>Proposed: <code>saml.sso.default-success-url= https://ui.domain.com/</code></p>
  
  <p>With the above, the SAML response supposed to go directly to UI (after ping authentication is successful).</p>
  
  <p>However we couldn’t get the response in UI and it also behaves like ping is doing a redirection to UI and due to the same reason, UI doesn’t get it.</p>
  
  <p>Any ideas and suggestions over this would be great.</p>