Symptoms

When browsing to a bookmarked Confluence URL, users are required to authenticate and thus are redirected to the login page. After login, they are redirected back to the dashboard rather than the page they were originally trying to view. This only affects pages that have spaces in the title, and only on WebSphere.

For example:

1. From outside of Confluence, user clicks on a URL like:

   http://example.com/confluence/display/SPACE/A+Home+Page
   

2. Since this is a protected space they are asked for credentials, and redirected to the login screen.

3. The URL changes to the following:

   {{http://example.com/confluence/login.action?os_destination=%2Fdisplay%2FSPACE%2FA+Home+Page}}
   

4. After logging in the URL is changed to:

   {{http://example.com/confluence/dashboard.action}}
   

Diagnosis

At step 3, change the URL and change the "+" to %2B:

{{http://example.com/confluence/login.action?os_destination=%2Fdisplay%2FSPACE%2FA%2BHome%2BPage}}

This will redirect to the proper page after login, as expected.

Cause

Simple
The issue occurs because WebSphere decodes the "+" to a space before passing to Confluence. This is a bug in WebSphere as reported on IBM's site. Search the IBM page for com.ibm.ws.webcontainer.decodeURLPlusSign.

Detailed
Unencoded plus characters work in URLs. However, they do not work for redirection because Confluence expects the parameter values to be encoded.

For example:

http://<HOST>:8080/login.action?os_destination=/display/space/Page%2B1 (http://<HOST>:8080/login.action?os_destination=/display/space/Page%2B1)

The parameter value for os_destination is "/display/space/Page%2B1". Confluence will decode this to "/display/space/Page+1" and when it creates a URI Java object for this, everything is fine.

However, if Confluence gets "/display/space/Page+1", it will decode this to "/display/space/Page 1", and when Confluence tries to create a URI from this it will error because a space is not valid syntax for a URI object. Because to this error you will be redirected back to the dashboard.

Thus, directly going to a URL with "+" will work. However, if the os_destination has "+" it will not work, since parameters should be encoded.

Resolution

As stated in the above article for Websphere 6.1, you will need to add the property "com.ibm.ws.webcontainer.decodeURLPlusSign" as false. In the Websphere administration interface, Go to Application servers > "server name" > Web container > Custom properties and add a new custom property named "com.ibm.ws.webcontainer.decodeURLPlusSign" with "false" as the value.

Related Articles

Login Does Not Redirect to Destination URL after Login