Issue
- Liferay automatically redirects users to specific public pages when incorrect URLs ending with numbers are entered. This behavior leads to the unintended exposure of these public pages to all users.
- Steps to reproduce:
-
- Open a browser and navigate to the Liferay DXP URL.
- Append a numeric value, such as
/2, to the domain (e.g.,http://localhost:8080/2) and press Enter. - Upon entering the URL, the user is redirected to another page, such as
http://localhost:8080/en/search. - This issue appears to be specific to numerical inputs. When a numeric value, like '2' is entered, the system performs an initial redirect with HTTP status code 302. This redirect leads to the
/en/searchendpoint, which subsequently responds with HTTP status code 200.
Environment
- Liferay DXP 7.2
Resolution
- This is the expected behavior of the product as the ability to access layouts by their ID has been a longstanding feature in Liferay.
- When accessing a URL such as
http://localhost:8080/2, the system redirects to the English version of the home page (http://localhost:8080/en/home) as Liferay defaults to English and providing a number at the end of the URL redirects a user to a page associated with the layout ID. Here, the number '2' denotes the Layout ID of a page. - However, a possible workaround to prevent the page redirection to public pages can be achieved by configuring the webserver to handle URLs ending with numbers and redirecting them to a 404 error page.
Additional Information
There is a feature request open to include this functionality in future releases of Liferay. Its progress can be followed at LPD-517. Voting for this request will also increase its visibility.