asp.net mvc authentication action doesn't get returnUrl

Question

In a classical example of asp.net/mvc authentication LogOn action gets LogOnViewModel and returnUrl string to do an authentication and redirect to previous Url.

[HttpPost]
public ActionResult LogOn(LogOnViewModel model, string returnUrl)
{
if (ModelState.IsValid)
    if (!FormsAuthentication.Authenticate(model.UserName, model.Password))                                              
        ModelState.AddModelError("", "Incorrect user name or password."); 

    if (ModelState.IsValid)
    {
        FormsAuthentication.SetAuthCookie(model.UserName, false);
        return Redirect(returnUrl ?? "Bookings");
    }
    else
        return View();
}

But when request is handled by action returnUrl parameter is null, however there should be a value as author says. Could anybody please explain this?

Form from which I send request look like this: Views/Admin/LogOn.aspx

<asp:Content ID="Content2" ContentPlaceHolderID="MainContent" runat="server">
  <div id="login">
    <% Html.EnableClientValidation(); %>
    <% using (Html.BeginForm("LogOn", "Admin")) { %>
      <%= Html.ValidationSummary(true) %>
      <div><label>Username:</label><input name="userName" type="text" /></div>
      <div><label>Password:</label><input name="password" type="password" /></div>
      <div><input type="submit" value="Login" /></div>
    <% } %>
  </div>
</asp:Content>

There is no hidden field generated on the form.

Authentication:

<authentication mode="Forms">
  <forms loginUrl="~/Admin/LogOn" timeout="2880">
    <credentials passwordFormat="SHA1">
      <user name="admin" password="hashedPassword"/>
    </credentials>
  </forms>
</authentication>

What does your submitting form look like? If you submit with a POST request, do you have a hidden element for the returnUrl parameter? — Tomas Aschan
– Tomas Aschan, Commented Nov 10, 2010 at 19:43

Remus · Accepted Answer · 2010-11-10 20:22:35Z

6

When you go to a page that isn't authenticated, the ReturnURL parameter is automatically added to your query string when you are redirected to the login page by the MVC framework.

Your current <form> tag in the view doesn't take this into account. It always goes to the same action disregarding any existing QueryString values.

If you use:

<% using (Html.BeginForm()) { %>
   // enter form html without the <form> tag
<% } %>

This will automatically create a <form> tag with 'action' value that takes into account any query strings that already exist on your page.

answered Nov 10, 2010 at 20:22

Remus

1,4533 gold badges14 silver badges24 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

Maxim Over a year ago

Action which user wants to invoke (www.mysite.com/Admin/Index) has [Authorize] attribute, that's why he is redirected to Logon page. Url on logon looks like www.mysite.com/Admin/LogOn?ReturnUrl=%2fAdmin%2findex /// using (Html.BeginForm()) didn't solve problem, still null in returnUrl

Remus Over a year ago

hmm, check that your variable is of the appropriate case: ReturnUrl

Maxim Over a year ago

Tried, didn't help. Request.QueryString is empty. It smells fishy, it should work. Routes for these requests routes.MapRoute( "AdminMainPage", "admin/{action}", new { controller = "Admin", action = "Index" } ); routes.MapRoute( "AdminLogOn", "admin/logon/", new { controller = "Admin", action = "LogOn" } ); Anyway thanks a lot for

Remus Over a year ago

Yeah, that was a bit of a long shot - can you update your question with the authentication settings in web.config and the new code in your view.

Remus Over a year ago

no prob - it was bugging me why it isn't working. I guess the Html.BeginForm(string, string) method doesn't carry any QueryString forward, which I guess makes sense, since there's a Html.BeginForm(string, string, object) overload to specify the QueryString parameters.

|

jrob · Accepted Answer · 2010-11-10 20:07:50Z

1

Maybe try including a hidden input element in your form:

<%:Html.Hidden("returnUrl", yourUrlHere) %>

answered Nov 10, 2010 at 20:07

jrob

5321 gold badge6 silver badges16 bronze badges

2 Comments

Maxim Over a year ago

I don't know from which page user was redirected to LogOn page. Is there any way to knew that?

jrob Over a year ago

See Comment by Remus it is automatically added. No need to add the hidden input element.

Collectives™ on Stack Overflow

asp.net mvc authentication action doesn't get returnUrl

2 Answers 2

8 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

8 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related