Need help with ReturnUrl in MVC 3 LoginPage

2
votes

I have this url in my login view: http://localhost:5550/login?ReturnUrl=/forum/456&theme=1

I get the right url value when I am in the login page. As you can see I have 2 query string parameters: ReturnUrl and theme So far good.

Now the login page posts a form to a controller action. All I need is to read the values of these 2 query string params. I just can't make it work.

This is my login page view:

@using (Html.BeginForm("try", "login"))
{
  //set text boxes and button so user can try login
}

This is my controller where I need those 2 values:

[HttpPost]
public ActionResult Try(LoginModel model, string ReturnUrl, string theme)
{     
   //read all query string param values...but how?
   //I am not getting anything in string ReturnUrl, string theme. They are null
}

Other part of the question:

I can debug other controller. But not this controller. Is this because I am posting a form using BeginForm? Doesn't make sense. But the breakpoint never hits even though I get error on browser.

3
asp.net-mvc-3

3 Answers

4
votes

Normally you shouldn't be reading from ReturnUrl. The flow works like this:

  1. Request to controller action which requires authentication using the [Authorize] attribute
  2. ASP.NET MVC adds the ReturnUrl and redirects to /Account/LogOn, automatically encoding and appending the ReturnUrl parameter
  3. The Account/LogOn POST controller action, after authenticating the login information, redirects to the URL in the ReturnUrl.

I wrote about that in gory detail in the following posts:

The second post indicates one good reason why need to be careful with ReturnUrl - users can tamper with them.

In the example you showed above, I'd expect that, after authorization, the user would be redirected to the Forum / Index action, which would then be reading the values. If you are creating the ReturnUrl, you should be URL Encoding the second &.

1
votes

Not sure on the exact reason the values don't get bound, but the easy workaround is to add those properties to your login model and add hidden fields on the form.

0
votes

Try changing the decoration:

[AcceptVerbs(HttpVerbs.Post)]
public ActionResult Try(LoginModel model, string ReturnUrl, string theme)
{     
   //read all query string param values...but how?
   //I am not getting anything in string ReturnUrl, string theme. They are null
}