The'redirect.url.domains.allowed' property somehow doesn't restrict redirection

Legacy Knowledge Base

Published Jul. 2, 2025

The'redirect.url.domains.allowed' property somehow doesn't restrict redirection

Written By

Kanchan Bisht

Legacy Article

You are viewing an article from our legacy "FastTrack" publication program, made available for informational purposes. Articles in this program were published without a requirement for independent editing or verification and are provided"as is" without guarantee.

Before using any information from this article, independently verify its suitability for your situation and project.

Issue

Even when the 'redirect.url.domains.allowed' property is set, some redirects occur.
Steps to reproduce:
1) Set the following properties in the portal-ext.properties file.
redirect.url.security.mode=domain
redirect.url.domains.allowed=localhost
2) Start up Liferay
3) The following URLs are redirected.
http://localhost:8080/html/common/referer_js.jsp?referer=//google.com/
http://localhost:8080/html/common/forward_js.jsp?FORWARD_URL=//google.com/
Expected Behavior: The browser should stay on localhost
Observed Behavior: The browser is being redirected to google.com

Environment

Liferay DXP

Resolution

The observed behavior is a known bug of Liferay DXP and is addressed by LPS-144696

Additional Information

If the hotfix is required for this issue, please create a support ticket requesting the hotfix by attaching the patch details.
Installing Fix Packs and Hotfixes on Liferay DXP will guide you to install the Fixpack/Hotfix in your environment.

Did this article resolve your issue ?