2010-09-15 09:03:20 8 Comments
I want to remove "returnurl=/blabla" from address bar when a user want to access to a login required page. Because I'm trying to redirect the user to a static page after login to do some selections.
How can I do that?
Related Questions
Sponsored Content
37 Answered Questions
13 Answered Questions
40 Answered Questions
7 Answered Questions
[SOLVED] Why does AuthorizeAttribute redirect to the login page for authentication and authorization failures?
- 2008-10-26 18:51:09
- Roger Lipscombe
- 87160 View
- 260 Score
- 7 Answer
- Tags: asp.net-mvc authentication authorization
43 Answered Questions
[SOLVED] A potentially dangerous Request.Form value was detected from the client
- 2008-09-17 10:58:14
- Radu094
- 939589 View
- 1442 Score
- 43 Answer
- Tags: asp.net asp.net-mvc validation html-encode request.form
14 Answered Questions
[SOLVED] RedirectToAction with parameter
- 2009-08-10 22:05:09
- Eric Brown - Cal
- 723557 View
- 558 Score
- 14 Answer
- Tags: c# asp.net-mvc controller redirecttoaction
9 Answered Questions
[SOLVED] ASP.NET MVC - Set custom IIdentity or IPrincipal
- 2009-06-30 15:18:15
- Razzie
- 205753 View
- 638 Score
- 9 Answer
- Tags: asp.net asp.net-mvc forms-authentication iprincipal iidentity
6 Answered Questions
[SOLVED] How can I get the client's IP address in ASP.NET MVC?
- 2010-04-05 08:25:17
- melaos
- 229609 View
- 303 Score
- 6 Answer
- Tags: asp.net-mvc
1 Answered Questions
Changing name of ReturnUrl parameter
- 2014-05-06 11:30:53
- haagel
- 86 View
- 0 Score
- 1 Answer
- Tags: asp.net asp.net-mvc
1 Answered Questions
[SOLVED] How do I keep my Login.aspx page's ReturnUrl parameter from overriding my ASP.NET Login control's DestinationPageUrl property?
- 2008-08-28 19:18:33
- Zack Peterson
- 5911 View
- 11 Score
- 1 Answer
- Tags: asp.net forms-authentication
11 comments
@Alberto Delgadillo 2017-09-27 17:36:32
If you want to remove returnURL from request and redirect to specific path, you can follow this steps.
Firstly get the current context, verify if the user is authenticated and finally redirect the current path.
I put this code into Page_Load method from my class Login.aspx.cs
@Adam 2016-11-13 09:25:04
You can use the HttpUtility.ParseQueryString to remove that element. If you use VB.NET then this code does this
I would put this in the Page.Init event - obviously you will need to change the "/default.aspx" to match the URL of your login page.
@Otto 2016-02-13 07:24:57
@Fio 2011-08-31 20:00:31
Add a location tag to your
web.config
. If your page is in a subdirectory, add theweb.config
to the subdirectory.ASP will overlook adding the
ReturnUrl
querystring and directing to login.@meda 2013-10-10 17:59:16
wow, I had this issue look here stackoverflow.com/questions/19301787/… Thanks it helped me, and we had the same page name :)
@Rohith 2013-01-18 09:59:12
if you are using asp.net control loginstatus then click on login status control press f4( for properties) under behavior section we can see LogOutAction there select Return to Login page.
Note: In order to implement it successfully you must have a login page with name login.aspx
@George Birbilis 2016-06-22 16:00:47
it's called "Redirect to Login page" (and in markup it is LogoutAction="RedirectToLoginPage")
@Amin 2014-10-23 01:46:01
@Carlos Candeias 2014-06-20 12:21:48
Simple...
Webconfig
@Ronen Festinger 2014-12-29 00:42:01
In my case I had to change the path in startup.auth.cs and not in web config:
app.UseCookieAuthentication(new CookieAuthenticationOptions { AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie, LoginPath = new PathString(("/Account/LoginRedirect")), ...
I also used RedirectToActionPermanent instead of RedirectToAction because it's pernament.@Jim 2015-12-01 20:15:26
This is a good solution - the only caveat is that you would have the request to LoginRedirect in your browser history, so if someone hits the Back button once, it would bring them back to LoginRedirect and then right back to Login.
@William Humphreys 2012-03-20 23:45:42
Add this to your Global.asax file.
@Krishna Thota 2012-11-15 11:15:27
stackoverflow.com/questions/13394999/… I'm using Custom forms Authentication. If I use the code which you have given the control loops over and over and it says -
Too many Redirects
. I think the problem is, when the Control goes toLogin
Page likemywebsite.com/Login
, then It checks for authentication and It redirects toLogin.aspx
page. and your code redirects again toLogin
page . This loop continues. Can you help me with this ???@Roberto 2016-04-14 22:19:47
Don't we need a
:base()
in MvcApplication constructor?@Aivan Monceller 2010-12-30 04:02:17
Create a custom Authorize Attribute
then use it on your controller
@Pierluc SS 2013-07-04 19:09:58
I prefer this solution, although I believe it makes more sense to have the code in
HandleUnauthorizedRequest
and use this line insteadfilterContext.Result = new RedirectResult( FormsAuthentication.LoginUrl );
@Scott Mitchell 2010-09-15 22:57:43
As RPM1984 pointed out, you don't have to redirect the user to the specified URL after signing in.
If it is imperative that you remove the
ReturnUrl
querystring parameter there are a couple options. Probably the easiest is in your login web page / controller you'd check for the existence of aReturnUrl
parameter in theRequest.QueryStrings
collection. If it exists, you could do a redirect back to the login page, but without theReturnUrl
.Another option would be to create a custom implementation for the
FormsAuthenticationModule
, which is the class that handles authenticating a user based on their form authentication ticket and is responsible for redirecting unauthorized users to the login page. Unfortunately, theFormsAuthenticationModule
class's methods are not virtual, so you can't create a derived class and override the methods needed, but the good news is that the class is pretty simple - just maybe 100-200 lines of code in total, and using Reflector you could quickly create your own customFormsAuthenticationModule
class. If you go this route (which I wouldn't recommend), all that you'd need to do would be to take out the code in theOnLeave
method that tacks on theReturnUrl
parameter. (In addition to modifying this class you'd also need to configure your Web.config file so that your application uses your customFormsAuthenticationModule
class rather than the one in the .NET Framework.)Happy Programming!
@RPM1984 2010-09-15 10:16:17
This is the nature of Forms Authentication. (which im guessing you're using).
That is, when you access a page which requires authentication, ASP.NET will redirect you to the login page, passing in the ReturnUrl as a parameter so you can be returned to the page you came from post-login.
To remove this functionality would break the semantics and design of Forms Authentication itself. (IMO)
My suggestion - if you dont need it, dont use it.
Piece of cake - after you've done your login, instead of doing FormsAuthentication.RedirectFromLoginPage (which uses that very ReturnUrl QueryString parameter), just use FormsAuthentication.SetAuthCookie and redirect wherever you want.
@Ali Ersöz 2010-09-15 19:57:11
FormsAuthentication.SetAuthCookie is what I'm doing right now.I just want to remove it from address bar.
@RPM1984 2010-09-15 21:58:34
Then my first comment stands - you may as well not use Forms Authentication at all. There is no easy way to do this (that i know of). Remebering ANY page can redirect to the login page (and ASP.NET does this). Only way i can think of is to hook into a Global.asax event and rewrite the URL. Why do you care if the URL is there?
@RPM1984 2010-09-15 21:59:34
and that comment contradicts your comment "Because I'm trying to redirect the user to a static page after login to do some selections.". The ReturnURL will not prevent you from doing your own redirect after login, UNLESS you're using RedirectFromLoginPage, which you have said you arent. So i dont know what youre issue is. How is the ReturnUrl preventing you from doing a redirect?
@Julien N 2011-04-18 13:46:46
I guess this is preventing nothing. It's just that, as this information is not used, it would be nice to not have it.
@TheSmurf 2013-01-24 20:37:38
The data in the RedirectUrl part of the query string can potentially be used in an enumeration attack, depending on what it shows. There are legitimate reasons to hide that data from the user.
@RPM1984 2013-01-24 22:45:55
@DannySmurf - no it can't. The RedirectUrl has exactly that - a URL and nothing more, no login information whatsoever.
@TheSmurf 2013-01-29 17:34:51
That's incorrect. It's not a URL and nothing more; whatever is in the query string is also relayed. Depending what the application has dumped in there, there is of course a possibility that there's information that could be exploited. That's a particular danger in a multi-user environment. It's also a danger for larger/corporate applications, parts of which are less cautious about redirects that happen before authentication. Any application information is a potential vector for an enumeration attack, not just login information... There are legitimate reasons to hide this data from the user.
@RPM1984 2013-01-30 23:29:05
Okay, take your point. I was under the assumption that the "previous" page did not have any sensitive information in the URL/querystring.