How to keep request.referer value from redirect after a failed login
I recommend you to pass a parameter like login/?next=pageA.html
If the login fails, you could then forward your parameter next to /login again, even if the referrer points now to /login.
Then when the user will successfully log in, you could redirect if to pageA.html that will be held in your next parameter.
You will indeed need to check if your parameter next is a valid one, as someone could copy-paste or try to tamper with this parameter.
I'm adding authentication to an existing pyramid project. The simplest form that I'm currently trying (will be expending later) is for all pages to raise HTTPForbidden. The exception view is /login, which will ask for login details and, on success, return HTTPFound with request.referer as the location.
So far so good, this does what I want, which is bringing users back to the page they were trying to access when the login page interrupted them. Let's call this Page A.
The login page is a simple HTML form with a submit button.
However if the user mistypes username or password, I want to return to the login page with an error message saying "Wrong password" or similar. When that happens, request.referer is now the login page instead of Page A.
How do I 'store' Page A (or rather its URL) so that, when the user eventually succeeds in logging in, they find themselves back on Page A? Is the session used for things like this, and are there non-session ways of implementing it? I don't (yet) have a session for this simple page, and am trying to avoid adding different components in one pass.