ReturnUrl in ASP.NET MVC

Question

I currently have a login link on my application that looks something like this:

<a href="/login?ReturnUrl=" + <%= Request.RawUrl %>>Login</a>

I want to handle the POST command on the login page in the controller action below:

[AcceptVerbs(HttpVerbs.Post)]
public ActionResult Login(string returnUrl)
{
    // Authenticate user

    return Redirect(returnUrl);
}

The problem here is if the RawUrl is something with multiple url parameters like "somepage?param1=1&param2=2&param3=3", then the returnUrl that gets passed into the Login action is truncated after the first ampersand: "somepage?param1=1".

I've tried UrlEncoding the RawUrl but that seem to make any difference. It seems that the ASP.NET MVC framework here is UrlDecoding the url params before mapping them to the controller action parameters, which ends up stripping off the additional url parameters I want to see in my returnUrl parameter.

Is there any way around this? I know I could just use Request.Path and parse out the values I need, but I thought I'd see if there was a cleaner approach first.

Craig Stuntz · Accepted Answer · 2009-04-22 18:47:43Z

39

You're probably encoding the links incorrectly. Yes, they do need to be encoded. Here is how we do it:

<a href="<%= Url.Action("Delete", "TimeRecord", 
    new RouteValueDictionary(new { id = timeRecord.AltId, 
    returnUrl=ViewContext.HttpContext.Request.Url.PathAndQuery }) ) %>">

answered Apr 22, 2009 at 18:47

Craig Stuntz

127k12 gold badges257 silver badges275 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

user1228 Over a year ago

This is good; PathAndQuery doesn't include the domain, so you're not vulnerable to an attacker using your server to redirect to their site.

Craig Stuntz Over a year ago

I wouldn't say you're not vulnerable. People can change the form data with Fiddler and the like. You still have to sanitize the URI at the server. On the other hand, it's good to not pre-populate the form with bad data. :)

Drew Noakes Over a year ago

Looks good. Beware though that ViewContext.HttpContext.Request.Url can return null, meaning that you may have a NullReferenceException.

enorl76 Over a year ago

This isn't the correct answer to this question. The correct answer is the one using Url.Encode(Request.RawUrl)

Nick Berardi · Accepted Answer · 2009-11-04 02:41:43Z

8

Make sure you URL encode the RawUrl before using it.

<%= Url.Encode(Request.RawUrl) %>

This should do it for you.

edited Nov 4, 2009 at 2:41

answered Apr 22, 2009 at 18:53

Nick Berardi

55k15 gold badges118 silver badges137 bronze badges

1 Comment

Nick Berardi Over a year ago

This works fine, the original post mis-analysed what was happening.

Collectives™ on Stack Overflow

ReturnUrl in ASP.NET MVC

2 Answers 2

4 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related