I have a Drupal 7 site that implements an OAuth Consumer using the OAuth module. I have a page callback defined for
/oauth/login that performs the first step of the dance, then redirects the user-agent to the authorization endpoint on the Provider via
drupal_goto(). The site is configured to restrict access to all pages for "Anonymous User", and the "Access Denied" page is set to my custom callback.
When visiting a page as an unauthenticated user, however, Drupal goes into an infinite redirect loop. I traced the problem down to the logic in
drupal_goto() itself, which inspects the value of
$_GET['destination'] and overwrites the
$path argument before ever inspecting the value provided, thereby redirecting to the original path. This seems like a bug to me, but I recognize that I might just be "Doin It Rong", too.
Looks like there are a couple of other questions out here that are similar:
- Drupal login not redirecting to SSO (external) server login page (Drupal 7)
- drupal_goto ignored in custom form submit handler (Drupal 7)
- Making drupal_goto Ignore ?destination=foo (Drupal 6)
Does anyone have any insight as to why this behavior exists? I understand why the "destination" path exists and what it's used for, but it seems to me that
drupal_goto() should only ignore the value of the
$path argument if no value has been passed or the value passed matches the currently executed path. If it's a real bug, I'll submit a patch and some tests to cover the use cases.