ReturnUrl = Default.aspx for MVC?

Question

I'm trying to secure my entire MVC site, so before the Home controller, I added an [Authorize] attribute.

Now if you run it from Visual Studio or navigate using the root URL (e.g. http://localhost:2897) it does redirect to the login page, as expected. However the URL in the address bar after redirection looks like this: http://localhost:2897/Account/LogOn?ReturnUrl=%2fdefault.aspx%3f

I haven't tested this out, seeing as I have not implemented my authentication code. However, this looks like a big problem to me, since I do not have a default.aspx in my project!

My authentication tag in the web.config looks like this:

<authentication mode="Forms">
   <forms loginUrl="~/Account/LogOn" defaultUrl="~/Home/Index" timeout="2880"/>
</authentication>

Why doesn't it pick up this route as the default ReturnUrl instead of default.aspx?

Answer 1

ASP.NET (to be precise, FormsAuthentication.RedirectFromLoginPage) always ignores the defaultUrl setting in web.config when a ReturnUrl parameter is present. It's only honored when you go directly to the login page without passing any ReturnUrl parameters.

ASP.NET MVC project template provides a blank Default.aspx template to handle requests like that in IIS Classic pipeline mode. You should be fine with that.