Hi Team,
After upgrading Jenkins to a newer version, we observed a behavior change during authentication/session timeout handling.
Environment:
• Jenkins behind reverse proxy
• SSO authentication enabled
• Users access Jenkins job URLs directly
Behavior:
- User opens a direct Jenkins job URL.
- If authentication/session expired, Jenkins redirects user to login.
- After successful authentication, user is redirected to Jenkins dashboard/home page instead of the originally requested job URL.
- Clicking the same URL again works correctly.
Additionally:
• After idle timeout (~30 mins), re-authentication again redirects users to dashboard instead of preserving the original job path.
Questions:
• Is this expected behavior in newer Jenkins/security updates?
• Is there any official Jenkins recommendation/configuration to preserve original requested URL after re-authentication?
• Is this related to security hardening/open redirect prevention?
• Are there reverse proxy or SSO headers/configurations recommended to preserve redirect path?
Thank you,
VenuReddy.