redirect_to_login Misinterprets next Parameter with Multiple Query Parameters

[Antoni Czaplicki]

There is a bug in the redirect_to_login function in django.contrib.auth.views. When the next parameter itself contains multiple query parameters (separated by &), they are incorrectly interpreted as part of the main login URL’s query parameters instead of being properly escaped as part of the next value.

Steps to Reproduce:

1. Configure Django view with required login decorator
2. Attempt to access a protected view with a next parameter containing multiple query parameters, e.g.:

/protected-view/?foo=1&bar=2

3. The user is redirected to the login page, where the generated login URL is:

/login/?next=/protected-view/?foo=1&bar=2

This is incorrect because &bar=2 is interpreted as a separate query parameter for /login/ instead of part of the next value.

4. After login, the user is redirected to:

/protected-view/?foo=1

Instead of the expected:

/protected-view/?foo=1&bar=2

Expected Behavior:
Ampersands in next parameter should be properly escaped so that it is treated as a single query parameter in the login URL. It should appear as:

/login/?next=/protected-view/?foo=1%26bar=2

so that after login, Django correctly redirects to:

/protected-view/?foo=1&bar=2

Affected Code:
The issue originates in redirect_to_login:

​https://github.com/django/django/blob/2d34ebe49a25d0974392583d5bbd954baf742a32/django/contrib/auth/views.py#L180

[Sarah Boyce]

Checked via a test and a test project, the parameters are escaped for me

tests/test_client/tests.py

@@ -557 +557 @@
         self.assertEqual(response.status_code, 200)
         self.assertEqual(response.context["user"].username, "testclient")
 
+    def test_view_with_login_with_query_parameter(self):
+        response = self.client.get("/login_protected_view/?foo=1&bar=2")
+        self.assertRedirects(response, "/accounts/login/?next=/login_protected_view/%3Ffoo%3D1%26bar%3D2")
+
     @override_settings(
         INSTALLED_APPS=["django.contrib.auth"],
         SESSION_ENGINE="django.contrib.sessions.backends.file",