Referer is not saved in the session for custom backend routes

[ameotoko]

Affected version(s)

4.13

Description

In my custom backend route, I have a link to the user profile, and I want the “Go back” button to lead back to my route. But this doesn’t work, the route is never stored in the session under 'referer', and the button leads to the last visited “core” backend url. Custom backend routes are skipped.

The developer docs say here:

If the scope is backend, <...> Contao will also automatically generate a "referer ID token" and store it as another request attribute under _contao_referer_id. Plus the current and last URL will be stored in the session. This is used in the back end for the "go back" links for example.

However, the referer is not actually stored in this case, because StoreRefererListener specifically checks for the contao_backend route here:

contao/core-bundle/src/EventListener/StoreRefererListener.php

Lines 88 to 97 in 74afbb0

	private function canModifyBackendSession(Request $request): bool
	{
	return !$request->query->has('act')
	&& !$request->query->has('key')
	&& !$request->query->has('token')
	&& !$request->query->has('state')
	&& 'feRedirect' !== $request->query->get('do')
	&& 'contao_backend' === $request->attributes->get('_route')
	&& !$request->isXmlHttpRequest();
	}

I was able to verify that by commenting out just that one line.

[fritzmg]

Imho we should just replace

&& 'contao_backend' === $request->attributes->get('_route') 

with something like

&& 'backend' === $request->attributes->get('_scope')
&& false !== $request->attributes->get('_store_referrer')

and adjust the backend routes of the Contao core that should not store the referer accordingly.

[leofeyer]

That sounds reasonable. Any other ideas?

[fritzmg]

One question is: should it be opt-in rather than opt-out. With my suggestion it would store the referrer by default and you can opt out - but that means we have to set '_store_referrer' => false for quite a lot of back end routes. However, opt-out would be more convenient for the App\ or back end routes from bundles.