cakephp/cakephp — pull request #633 by Phally (2012-05-04 15:13:00+00:00)
Title: Redirect check is breaking AuthComponent redirect status codes

The AuthComponent is supposed to send a 403 HTTP status code for denied AJAX requests, but it doesn't since Controller::redirect() was refactored to use the CakeRequest object.

See: https://github.com/cakephp/cakephp/blob/master/lib/Cake/Controller/Component/AuthComponent.php#L326

It used to work (in 1.3), because it worked a bit differently. There Controller::header() was called twice making sure the status code was set.

See: https://github.com/cakephp/cakephp/blob/1.3/cake/libs/controller/controller.php#L717

This pull request contains a test case for this and the fix.

Cheers!