ReturnUrl issue with asp.net mvc

Question

I have to deal with a legacy asp.net mvc app, which is not configured as I am used to. After a normal logout via:

FormsAuthentication.SignOut();

and

return RedirectToAction("Index", "Home");

the URI contains:

ReturnUrl=%2f

This is not usually the case. How can I suppress this?

Alternatively, when I try to access a page that requires authentication/authorization the login page appears but no appropriate ReturnUrl= is generated (i.e. the URI stays as it is).

Is this an IIS issue, which I have read somewhere, or is the asp.net FormsAuthenticationModule not properly configured? Thanks.

Answer 1

ReturnUrl is added during an unauthorized redirect. Someone appears to be redirecting the root url (/) to itself or to Home/Index. %2f is the encoded form of "/".

I would check the authorization section of the web.config for something that looks wrong.