Login target url parameter limit

[Peter Schober]

Hey Pavel,

* Pavel Šipoš <pavel.sipos at arnes.si> [2023-02-20 11:51]:
> We have set redirectLimit on Sessions element and its working for return url
> on logout but not on target parameter when logging in ( for example:
> /Shibboleth.sso/Login?target=https://google.com )
> Is ti possible to limit target url similarly to the redirectLimit on
> Sessions return url?

Works for me:
https://sp.example.org/Shibboleth.sso/Login?entityID=https://idp.example.org/&target=https://duckduckgo.com/

  opensaml::SecurityPolicyException at (https://sp.example.org/Shibboleth.sso/Login)
  Blocked unacceptable redirect location.

Best,
-peter