[
https://issues.apache.org/jira/browse/SLING-13025?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18126178#comment-18126178
]
Eric Norman commented on SLING-13025:
-------------------------------------
[~kwin] Can you maybe take another look at the solution that was done here?
After updating to the auth.core 2.1.0 release candidate in the starter project,
I see a new NPE when attempting to render the custom form login page
Below is the stack trace that was logged:
{noformat}
08.10.2026 13:36:20.202 *ERROR* [qtp691698687-65] org.apache.felix.http
Exception while processing request to /starter.login.html
java.lang.NullPointerException: Cannot invoke
"org.apache.sling.api.resource.ResourceResolver.map(jakarta.servlet.http.HttpServletRequest,
String)" because the return value of
"org.apache.sling.auth.core.AuthUtil.getResourceResolver(jakarta.servlet.http.HttpServletRequest)"
is null
at
org.apache.sling.auth.core.AuthUtil.getMappedLoginResourcePath(AuthUtil.java:227)
[org.apache.sling.auth.core:2.1.0]
at
org.apache.sling.auth.core.spi.DefaultJakartaAuthenticationFeedbackHandler.getValidatedRedirectTarget(DefaultJakartaAuthenticationFeedbackHandler.java:105)
[org.apache.sling.auth.core:2.1.0]
at
org.apache.sling.auth.core.spi.DefaultJakartaAuthenticationFeedbackHandler.handleRedirect(DefaultJakartaAuthenticationFeedbackHandler.java:80)
[org.apache.sling.auth.core:2.1.0]
at
org.apache.sling.auth.core.impl.SlingAuthenticator.getAnonymousResolver(SlingAuthenticator.java:920)
[org.apache.sling.auth.core:2.1.0]
at
org.apache.sling.auth.core.impl.SlingAuthenticator.doHandleSecurity(SlingAuthenticator.java:552)
[org.apache.sling.auth.core:2.1.0]
at
org.apache.sling.auth.core.impl.SlingAuthenticator.handleSecurity(SlingAuthenticator.java:494)
[org.apache.sling.auth.core:2.1.0]
at
org.apache.sling.engine.impl.SlingHttpContext.handleSecurity(SlingHttpContext.java:121)
[org.apache.sling.engine:3.0.4]{noformat}
> Default(Jakarta)AuthenticationFeedbackHandler should evaluate "resource"
> parameter as fallback for "sling.auth.redirect"
> ------------------------------------------------------------------------------------------------------------------------
>
> Key: SLING-13025
> URL: https://issues.apache.org/jira/browse/SLING-13025
> Project: Sling
> Issue Type: Improvement
> Components: Authentication Core
> Affects Versions: Auth Core 2.0.2
> Reporter: Konrad Windszus
> Assignee: Konrad Windszus
> Priority: Major
> Fix For: Auth Core 2.1.0
>
>
> As outlined in
> https://sling.apache.org/documentation/the-sling-engine/authentication/authentication-authenticationhandler/form-based-authenticationhandler.html#phase-1-form-submission
> {quote}
> The resource and sling.auth.redirect parameters provide similar functionality
> but with differing historical backgrounds. The resource parameter is based on
> the resource request attribute which is set by the login servlet to indicate
> the original target resource the client desired when it was forced to
> authenticate. The sling.auth.redirect parameter can be used by clients
> (applications like cURL or plain HTML forms) to request being redirected
> after successful login. If both parameters are set, the sling.auth.redirect
> parameter takes precedence.
> {quote}
> However the
> [DefaultJakartaAuthenticationFeedbackHandler|https://github.com/apache/sling-org-apache-sling-auth-core/blob/b8409ee840277cfaeb1f58c8648259b811f7789e/src/main/java/org/apache/sling/auth/core/spi/DefaultJakartaAuthenticationFeedbackHandler.java#L32C14-L32C57]
> and
> [DefaultAuthenticationFeedbackHandler|https://github.com/apache/sling-org-apache-sling-auth-core/blob/b8409ee840277cfaeb1f58c8648259b811f7789e/src/main/java/org/apache/sling/auth/core/spi/DefaultAuthenticationFeedbackHandler.java#L33]
> only evaluate {{sling.auth.redirect}}.
> In order to reduce the amount of parameters necessary it would be good to
> issue a redirect considering {{resource}} in case {{sling.auth.redirect}} is
> not set (as in most cases it is the desired behaviour to redirect to the
> resource which originally triggered the login).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
