ReturnUrl in ASP.NET MVC

Question

I currently have a login link on my application that looks something like this:

<a href="/login?ReturnUrl=" + <%= Request.RawUrl %>>Login</a> 

I want to handle the POST command on the login page in the controller action below:

[AcceptVerbs(HttpVerbs.Post)] public ActionResult Login(string returnUrl) {     // Authenticate user      return Redirect(returnUrl); } 

The problem here is if the RawUrl is something with multiple url parameters like "somepage?param1=1&param2=2&param3=3", then the returnUrl that gets passed into the Login action is truncated after the first ampersand: "somepage?param1=1".

I've tried UrlEncoding the RawUrl but that seem to make any difference. It seems that the ASP.NET MVC framework here is UrlDecoding the url params before mapping them to the controller action parameters, which ends up stripping off the additional url parameters I want to see in my returnUrl parameter.

Is there any way around this? I know I could just use Request.Path and parse out the values I need, but I thought I'd see if there was a cleaner approach first.

Answer 1

You're probably encoding the links incorrectly. Yes, they do need to be encoded. Here is how we do it:

<a href="<%= Url.Action("Delete", "TimeRecord",      new RouteValueDictionary(new { id = timeRecord.AltId,      returnUrl=ViewContext.HttpContext.Request.Url.PathAndQuery }) ) %>">