ReturnUrl in ASP.NET MVC

Question

I currently have a login link on my application that looks something like this:

<a href="/login?ReturnUrl=" + <%= Request.RawUrl %>>Login</a>

I want to handle the POST command on the login page in the controller action below:

[AcceptVerbs(HttpVerbs.Post)]
public ActionResult Login(string returnUrl)
{
    // Authenticate user

    return Redirect(returnUrl);
}

The problem here is if the RawUrl is something with multiple url parameters like "somepage?param1=1&param2=2&param3=3", then the returnUrl that gets passed into the Login action is truncated after the first ampersand: "somepage?param1=1".

I've tried UrlEncoding the RawUrl but that seem to make any difference. It seems that the ASP.NET MVC framework here is UrlDecoding the url params before mapping them to the controller action parameters, which ends up stripping off the additional url parameters I want to see in my returnUrl parameter.

Is there any way around this? I know I could just use Request.Path and parse out the values I need, but I thought I'd see if there was a cleaner approach first.

Answer 1

You're probably encoding the links incorrectly. Yes, they do need to be encoded. Here is how we do it:

<a href="<%= Url.Action("Delete", "TimeRecord", 
    new RouteValueDictionary(new { id = timeRecord.AltId, 
    returnUrl=ViewContext.HttpContext.Request.Url.PathAndQuery }) ) %>">

Answer 2

Okay, your solution has a smell to it; I can't put my finger on a link describing the attack (its gotta be a session hijack of some sort), but blindly redirecting via a querystring has GOT to be a security hole. Somebody answer or comment with the info, pls.

Without thinking about the security aspect of this, one quick solution would be to Base64 encode the entire return url. Here's some code I completely ganked from a blog which may or may not work:

public static string ToBase64(this HtmlHelper me, string toEncode)
{
      byte[] toEncodeAsBytes
            = System.Text.ASCIIEncoding.ASCII.GetBytes(toEncode);
      string returnValue
            = System.Convert.ToBase64String(toEncodeAsBytes);
      return returnValue;
}

public static string FromBase64(this HtmlHelper me, string encodedData)
{
      byte[] encodedDataAsBytes
          = System.Convert.FromBase64String(encodedData);
      string returnValue =
         System.Text.ASCIIEncoding.ASCII.GetString(encodedDataAsBytes);
      return returnValue;
}

Answer 3

Make sure you URL encode the RawUrl before using it.

<%= Url.Encode(Request.RawUrl) %>

This should do it for you.