I have a Drupal 7 site that implements an OAuth Consumer using the OAuth module. I have a page callback defined for /oauth/login that performs the first step of the dance, then redirects the user-agent to the authorization endpoint on the Provider via drupal_goto(). The site is configured to restrict access to all pages for "Anonymous User", and the "Access Denied" page is set to my custom callback.

When visiting a page as an unauthenticated user, however, Drupal goes into an infinite redirect loop. I traced the problem down to the logic in drupal_goto() itself, which inspects the value of $_GET['destination'] and overwrites the $path argument before ever inspecting the value provided, thereby redirecting to the original path. This seems like a bug to me, but I recognize that I might just be "Doin It Rong", too.

Looks like there are a couple of other questions out here that are similar:

Does anyone have any insight as to why this behavior exists? I understand why the "destination" path exists and what it's used for, but it seems to me that drupal_goto() should only ignore the value of the $path argument if no value has been passed or the value passed matches the currently executed path. If it's a real bug, I'll submit a patch and some tests to cover the use cases.

  • 1
    You'd have to ask on Drupal.org really, I'd be surprised if anyone here knew the motivations behind the workflow of an arbitrary core function that was created that many years ago. It's almost certainly not a bug, it's been that way since Drupal 4.6. I'd like to think someone would have caught that by now if it's unintentional :) Either way, if you feel this is a bug I'm afraid you're in the wrong place - it'll need to be reported to the core issue queue
    – Clive
    Commented Sep 17, 2013 at 15:21
  • @Clive: Understood. Really just soliciting attention to the problem. Totally open to another way to do it, and I understand that drupal_goto() expires in D8, as well.
    – AL the X
    Commented Sep 17, 2013 at 15:36
  • It is (thankfully). For the record I've always puzzled over the same thing - I just accept it these days and work around with unsetting GET vars or resetting static caches. I'd love to know they why as well, just not sure this is the best place to get the answer
    – Clive
    Commented Sep 17, 2013 at 15:50


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.