Question

Say a user is browsing a website, and then performs some action which changes the database (let’s say they add a comment). When the request to actually add the comment comes in, however, we find we need to force them to login before they can continue.

Assume the login page asks for a username and password, and redirects the user back to the URL they were going to when the login was required. That redirect works find for a URL with only GET parameters, but if the request originally contained some HTTP POST data, that is now lost.

Can anyone recommend a way to handle this scenario when HTTP POST data is involved?

Obviously, if necessary, the login page could dynamically generate a form with all the POST parameters to pass them along (though that seems messy), but even then, I don’t know of any way for the login page to redirect the user on to their intended page while keeping the POST data in the request.

---

Edit : One extra constraint I should have made clear – Imagine we don’t know if a login will be required until the user submits their comment. For example, their cookie might have expired between when they loaded the form and actually submitted the comment.

Answer 1

2 choices:

1. Write out the messy form from the login page, and JavaScript form.submit() it to the page.
2. Have the login page itself POST to the requesting page (with the previous values), and have that page’s controller perform the login verification. Roll this into whatever logic you already have for detecting the not logged in user (frameworks vary on how they do this). In pseudo-MVC:

         CommentController {            void AddComment() {              if (!Request.User.IsAuthenticated && !AuthenticateUser()) {                 return;              }              // add comment to database            }             bool AuthenticateUser() {              if (Request.Form['username'] == '') {                 // show login page                 foreach (Key key in Request.Form) {                    // copy form values                    ViewData.Form.Add('hidden', key, Request.Form[key]);                 }                 ViewData.Form.Action = Request.Url;                  ShowLoginView();                 return false;               } else {                  // validate login                  return TryLogin(Request.Form['username'], Request.Form['password']);               }             }         }