Advanced redirection after login

After a successful sign-in, Exponential can send each user, or every member of a user group, to an address stored on the user's or the group's own object. A user who signs in from the login form without a target goes there instead of to the front page.

How it works

When a sign-in succeeds and the login form did not already carry a target, the user/login view looks for an address in this order:

1. the text attribute named in LoginRedirectionUriAttribute[user] on the user's own object;
2. the attribute named in LoginRedirectionUriAttribute[group] on the user's groups: the group of the main location first, then the first other group with a non-empty value;
3. [SiteSettings] DefaultPage of site.ini (/content/view/full/2/ by default).

A target the login form already has wins: the hidden RedirectURI field, or the page the visitor was on before the sign-in (kept in the session as LastAccessesURI). Only an empty target or / lets the per-user and per-group address take over.

Setting it up

1. Add a Text line attribute to the user class (and, for groups, to the user group class) under Setup > Classes, for example with the identifier front_page_uri. Give every user class the same identifier.
2. Name the attribute in an override of site.ini, for example settings/siteaccess/<public siteaccess>/site.ini.append.php:

[UserSettings]
# the text attribute of the user class that holds the address
LoginRedirectionUriAttribute[user]=front_page_uri
# the text attribute of the user group class
LoginRedirectionUriAttribute[group]=front_page_uri

1. Clear the INI cache: php bin/php/ezcache.php --clear-tag=ini.
2. Edit a user or a group (Users tab) and enter an address such as /news in the new field.

Both keys are commented out in the shipped settings/site.ini, so the feature is off until you set them. An attribute name that the user's class does not have writes a warning to the debug output and is skipped.

Always using the stored address

To make the stored address win even when the visitor came from another page, let your own user/login.tpl override post / as the target:

<input type="hidden" name="RedirectURI" value="/" />

A user without a stored address, in a group without one, then always lands on DefaultPage.

Limits

• The address is used as a redirect target, and redirect targets pass the rules of Safe redirects.
• It applies to the web login form. Sign-ins through the REST interface, WebDAV or SOAP do not redirect.

Related pages

• site.ini [UserSettings]
• Safe redirects and "back to where you came from"