Python实现CAS登录遇阻：redirect-url来源不明求助

Hey, let's unpack where that tricky redirect-url parameter is coming from—CAS login flows can be opaque with all the redirects, but we can trace it step by step using your request sequence.

1. It starts with your initial visit to abc.com #

Your first request is GET https:/abc.com/, which I'm guessing is a CAS-protected resource (since it kicks off the CAS login flow). Here's what's likely happening:

• When you hit this unauthenticated, the abc.com backend generates that redirect-url value (probably tied to your session, a specific resource you're trying to access, or a pre-configured route) and packages it into the service parameter used to redirect you to the CAS login page.
• You mentioned the response only has an eTag="1234xyz", but don't overlook two things:
  • The response might have a Location header (a server-side redirect) that your browser automatically followed—check your dev tools' "Preserve log" option to catch this initial redirect, since browsers often hide intermediate steps.
  • If there's no server redirect, the abc.com page probably has client-side JavaScript that reads a hidden value (like a rendered <input type="hidden"> with the redirect-url) or a backend-injected variable, then builds the CAS login URL and redirects you.

2. The CAS login page receives the redirect-url via the service parameter #

Your second request is https:/cas1.abc.com/cas/login?service=abc.com/webapi/j_spring_cas_security_check?redirect-url=abcdef123xyz—notice the service parameter already includes the redirect-url. That means this value was passed to CAS directly from abc.com, not generated by CAS itself (CAS typically just forwards the service parameter through the flow).

3. It’s carried through to the final POST via session or page state #

The third GET request to someother url;jsessionid=A1234 is almost certainly a static asset (CSS/JS) or an intermediate page loaded by the CAS login screen. The redirect-url is preserved here either:

• In the JSESSIONID cookie tied to your CAS session, so CAS can reference it when building the final POST request.
• In the CAS login page's HTML (like a hidden form field) that gets included when you submit the login form via POST.

Quick checks to confirm the source #

To nail down exactly where it's coming from:

• Re-run the flow with "Preserve log" enabled in dev tools—this will show you the full chain, including any hidden redirects from abc.com.
• View the source of the CAS login page (https:/cas1.abc.com/cas/login?service=...) and search for abcdef123xyz—you’ll probably find it in a hidden form input or embedded JS variable.
• Check your browser's SessionStorage/LocalStorage for the value—some apps store redirect targets there temporarily.

内容的提问来源于stack exchange，提问作者Ghost