Redirect to default space_selector after login via external link

1

Hello,

I upgraded KBN and ES ROR 8.19.7 from 1.69.1 to 1.70.3 and I have discovered some suspicious behaviour.

When I’m not logged in kibana, then try to use external redirect link to kibana search query e.g

http://kibana_http_address/kibana_instance_name/s/space_name/app/discover#/?_g=(refreshInterval:(pause:!t,value:0),time:(from:'2026-07-23T08:16:21.850Z',to:'2026-07-23T14:16:21.850Z'))&_a=(columns:!(X,Y,Z),dataSource:(dataViewId:'XXXX',type:dataView),filters:!(),interval:'5m',query:(language:kuery,query:'event.type:%20error'),sort:!(!('@timestamp',desc)))

I get ROR login screen, so that’s OK. But then, when I log in to kibana via ROR, I get redirected to the default

http://kibana_http_address/spaces/space_selector

When I use again(being already logged in) the same(above) link for “search query“, I get redirected correctly to expected results in specific kibana space.

Were there any changes between versions <1.69.1 - 1.70.3> in this “area”?

2

Additionally I see these logs in kibana.log file after I log in:

[info][plugins][ReadonlyREST][authController][x-ror-correlation-id=XXXX] Refreshing session against ES
[ERROR][http] 400 Bad Request
[warning][plugins][ReadonlyREST][authController][x-ror-correlation-id=YYYY] Blocked nextUrl with control/whitespace bytes: /kibana_instance_name/s/space_name/app/discover#/?_g=(refreshInterval:(pause:!t,value:0),time:(from:'2026-07-23T08:16:21.850Z',to:'2026-07-23T14:16:21.850Z'))&_a=(columns:!(X,Y,Z),dataSource:(dataViewId:'XXXX',type:dataView),filters:!(),interval:'5m',query:(language:kuery,query:'event.type: error'),sort:!(!('@timestamp',desc)))#/?_g=(refreshInterval:(pause:!t,value:0),time:(from:'2026-07-23T08:16:21.850Z',to:'2026-07-23T14:16:21.850Z'))&_a=(columns:!(X,Y,Z),dataSource:(dataViewId:'XXXX',type:dataView),filters:!(),interval:'5m',query:(language:kuery,query:'event.type: error'),sort:!(!('@timestamp',desc)))
[WARN ][plugins.security.routes] Cannot record authentication type: current user could not be retrieved.

+ sometimes

[ERROR][savedobjects-service.repository.point-in-time-finder] Failed to open PIT for types [tag]
3

Hello @mikeIT

I will try to reproduce the problem locally

Were there any changes between versions <1.69.1 - 1.70.3> in this “area”?

Yes, we made the nextUrl validation more restrictive. Based on this log, some of the nextUrl part is unsafe now

[warning][plugins][ReadonlyREST][authController][x-ror-correlation-id=YYYY] Blocked nextUrl with control/whitespace bytes: /kibana_instance_name/s/space_name/app/discover#/?_g=(refreshInterval:(pause:!t,value:0),time:(from:‘2026-07-23T08:16:21.850Z’,to:‘2026-07-23T14:16:21.850Z’))&_a=(columns:!(X,Y,Z),dataSource:(dataViewId:‘XXXX’,type:dataView),filters:!(),interval:‘5m’,query:(language:kuery,query:‘event.type: error’),sort:!(!(‘@timestamp’,desc)))#/?_g=(refreshInterval:(pause:!t,value:0),time:(from:‘2026-07-23T08:16:21.850Z’,to:‘2026-07-23T14:16:21.850Z’))&_a=(columns:!(X,Y,Z),dataSource:(dataViewId:‘XXXX’,type:dataView),filters:!(),interval:‘5m’,query:(language:kuery,query:‘event.type: error’),sort:!(!(‘@timestamp’,desc)))