Aug 12th, 2012, 03:08 PM
Using a different URL after flow has started
1. Access /app/user/pswd
2. Will be redirected to /app/user/pswd?execution=e1s1
3. Access /app/user/profile?execution=e1s1 (this is also a valid flow in my app)
4. Still see the same page. Subsequently, submitting the form will be successful.
5. Alternatively, use Fiddler2 to intercept form submission and POST to "/app/user/profile?execution=e1s1" instead. It still works.
Is this the expected result? With a valid "execution" value, should the application allow using of different URLs?
One of HDIV's feature is to prevent users from submitting the form with a different "action" value. Any advice is much appreciated.
Last edited by evilcouncil; Aug 12th, 2012 at 03:10 PM.
Reason: do not use full sample urls