When a user logs in, I want to redirect them to another page if they have a certain role.
In Drupal 7, I'd use drupal_goto() in an implementation of hook_user_login() to do the redirect, and hook_module_implements_alter() to make sure that my module is last in the list, so that everything else gets a chance to run.
In Drupal 8, drupal_goto() was removed and it seems that performing a redirect outside of a controller is not a supported use case.
On that page, gngn has the same problem, and manually generates a RedirectResponse and sends it.
The problem is that, as I see it, the send() doesn't terminate the request and the page will have two HTML documents: a 'redirecting to...' page, followed by whatever page would have been there in the first place. Which could be a security issue.
johnvb notes this, and inserts a call to exit() after the send().
But presumably something useful is being done in the $kernel->terminate() call in index.php, which is being bypassed by calling exit().
In Drupal 7, drupal_goto() called drupal_exit() to handle this problem. Drupal 8 has removed drupal_exit().
That page says that modules needing to interrupt the request flow should throw an HTTP exception, but there are no 'redirect' exceptions.
As the user login also does a redirect, another approach would be to alter the redirection URL, as suggested on the drupal_goto() change record link above.
However, that approach will result in my method being called on every single request, which for what I'm doing seems insanely wasteful.
So, how should I perform a redirect from within a form alter in Drupal 8?