Working with query strings

Question

I just integrated a single sign-on provider into my application, which is now sending a query string parameter when it redirects back to the requested page, which causes the page to not load. The way it is set up is:

I have a controller at localhost/AppName/Controller, whose Index method requires [Authorize]
Forms authentication redirects to the SSO
SSO redirects to localhost/AppName/Controller/?ticket=stringvalue
Page doesn't load (browser has a "cannot display the web page" message); removing the ?ticket business makes the page load.

My Index method looks like this:

public ActionResult Index(string ticket)

which I thought would accept the query string parameter. I am using the default route configuration, that is:

routes.MapRoute(
    // Route name
    "Default", 
    // URL with parameters
    "{controller}/{action}/{id}", 
    // Parameter defaults
    new { controller = "Home", action = "Index", id = UrlParameter.Optional } 
);

does it work if the full url is used - i.e. /Home/Index?ticket=ticket? — Andras Zoltan
– Andras Zoltan, Commented May 24, 2011 at 12:54
When you remove the ?ticket business, is the Index action still executed? — David Fox
– David Fox, Commented May 24, 2011 at 12:59

Andras Zoltan · Accepted Answer · 2011-05-24 13:03:12Z

1

There is clearly something screwy about this - because there is no good reason why this should not work.

I'll bet if you take off the [Authorize] attribute you'll find that it works with the ?ticket=[value] bit in the Url.

If so, then I reckon Forms auth is getting stuck in a redirect loop (and the browser, after a while will simply refuse to continue) - I think it's not treating the current User as IsAuthenticated=true and so redirects to your SSO. The SSO says that the user is logged in and so redirects with the ticket parameter - ad nauseam.

You can debug this simply with the VS debugger and breakpointing your action method. Equally debugging at the Http level is often easier: download Fiddler and then hit your site using the special name http://ipv4.fiddler instead of http://localhost once it's up and running.

There must be more to your code that you haven't included, though - presumably somewhere you have code that intercepts the ticket and sets the user to be authenticated before the MVC action method kicks in? If so - I reckon that's failing.

answered May 24, 2011 at 13:03

Andras Zoltan

42.4k13 gold badges109 silver badges160 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

raoul1034 Over a year ago

Since I can't submit my own answer, I'll just throw this in here: I was dumb. Had the server name set as 'localhost' instead of 'localhost'.

Andras Zoltan Over a year ago

Ah - now I would like to say that I've never done that before... but I can't ;)

Collectives™ on Stack Overflow

Working with query strings

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related