XenForo 2 redirect_to parameter on Login URL not working

[releaseWeek]

I just upgraded to V2. In V1, I had login links with redirect_to that let users to redirect to that URL after login. But this is no more working after i upgraded to V2.

 

[Chris D]

We've never supported redirect_to in XF1. I suspect you're thinking of redirect.

In XF2 it has changed to _xfRedirect.

 

[releaseWeek]

Thanks @Chris D for the response. Yes, it was redirect in XF1 instead of redirect_to.

But _xfRedirect is not working in XF2. I'm using this URL to login

https://www.toonzone.net/forums/index.php?login&_xfRedirect=https://www.toonzone.net/fansites/

It doesn't redirect user to the specified URL after login.

 

[Chris D]

Works fine here:

https://xenforo.com/community/login?_xfRedirect=https://xenforo.com/community/resources/

 

[Napalm_beach]

Adding this here in case others find it searching the same problem. I could not make xf_Redirect work either, but here's what I found in my testing:

- xf_Redirect appears to be ignored if the redirect is to a different domain. It may also fail if http:// is in the url, I'm not sure.

- xf_Redirect works perfectly when redirecting to a file in its root directory. I set it up that way and made a file in the XF root that redirects to the desired url

An ugly hack but it works.

 

[doublespaces]

There is a very clear and obvious reason they don't redirect to external domains, that is a huge risk for phishing attacks as it is an open redirect.

Understanding and Discovering Open Redirect Vulnerabilities

One of the most common and largely overlooked vulnerabilities by web developers is Open Redirect (also known as "Unvalidated Redirects and Forwards").

www.trustwave.com