tags:

views:

404

answers:

2

I've seen some questions about e.g redirecting to the calling page

but the general suggestion is to pass in the redirect url as a parameter or check the referrer url.
1. Are these really the only 2 solutions? 2. What about keeping track of the latest page visited.. Is that viable and/or possible? 3. Any other options?

Forgot to add I need to stay away from javascript

+1  A: 

Just use the URL Referer [sic] header.

var requestFrom = Request.UrlReferrer

You can find the documentation at: http://msdn.microsoft.com/en-us/library/system.web.httprequest.urlreferrer.aspx

The only time this wouldn't work is when the page is requested directly, but in that case you wouldn't have any place to redirect to anyways.

The other option is of doing the request async using AJAX, so that your Delete action only does what it describes and isn't responsible for doing something outside of its intended purpose of deleting.

Nick Berardi
I was hoping to stay away from urlreferrer since its not safe and needs sanitizing :-(
David Archer
actually UrlReferrer comes in as a System.Uri, so it is already has some kind of built in protection, as far as being escaped and what not. But basically they are going to be redirected back to the page in which they came. Also I don't know how you would find anything safer if you take the input from the POST request.
Nick Berardi
+2  A: 

Sometimes the referrer is not possible. Imagine a login form that does some validation, you enter the wrong password, it comes back with a red error message, and then the referrer is wrong. Of course, in that case, the query string solution would work.

But alternatively, you can

  • use a hidden form field
  • store the last page in a session object on the server
  • serialize the return url to JSON and use Javascript to do the redirect

(I'm not saying that these options are good or bad, they're all I could think of right now)

OutOfMemory