Property "redirect.url.domains.allowed" does not allow for subdomains

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 6.2.X EE, 7.0.1 CE GA2
• Fix Version/s: 6.2.X EE, 7.0.1 CE GA2
• Component/s: Application Security
• Labels:
  • ee-ts
  • liferay-fixpack-portal-168-6210
• Branch Version/s:
  6.2.x
• Backported to Branch:
  Committed
• Story Points: 1.25
• Fix Priority: 2
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/39664

Property "redirect.url.domains.allowed" does not allow for subdomains.

Steps

1. Add test.com and a.test.com to hosts file.
2. Set the following in portal-ext.properties

   redirect.url.security.mode=domain
   redirect.url.domains.allowed=*.test.com
   

3. Start Liferay and navigate to Control Panel > Configuration > Instance Settings.
4. Change the default instance's virtual host to test.com.
5. Navigate to the default Site's Site Administration > Configuration > Site URL page.
6. Set the site's virtual host to a.test.com and the friendly URL to /a.test and save.
7. Navigate to test.com:8080/web/a.test
8. Sign in
9. Create a basic web content article in the control panel
10. Click on the article

Expected
Redirect is displayed and no warning is logged.
Actual
Redirect is displayed and "Redirect URL . . . is not allowed" warning is logged.