IIS 7 With Url Rewrite Module 2.0 - Setting 401 Status Codes And The ReturnUrl

I have a website hosted on IIS7 with the url rewrite module 2.0 installed. It is run by content management that looks at the url and returns a 401 error if the current user does not have permission to view the page. This gets picked up by the asp.net url authorization module which then kicks the page over to the loginUrl page as specified in the web.config (forms authentication).

This works perfectly on my local machine - which is IIS7 and windows7.

If the url is, say, /612/some-string the user gets directed to the login page at /66/login?ReturnUrl=/612/some-string

The url rewriting looks at the first part of the url for the document id. The real url would be this: index.aspx?documentId=612

Unfortunately, when I deployed this to our staging server, the ReturnUrl isn't the rewritten url, it's the original url. This causes all sorts of problems.

The staging server is also IIS7 with the url rewrite module 2.0 installed. It's Windows 2008 server SP2. Both are running asp.net 3.5.

My only guess is that the machine.config orders the default httpModules differently, and the .net forms authentication module is jumping in before the url has been rewritten.

I'll review that soon, but in the meantime has anyone experienced this problem and solved it?

Update

I also tried changing

Response.StatusCode = 401;

to

FormsAuthentication.RedirectToLoginPage();

Which gets me a bit ahead, but still directs the user back to the url that hasn't been rewritten.

I can also do this instead of setting the 401:

string currentPage = HttpUtility.UrlEncode(Request.RawUrl);
string loginUrl = FormsAuthentication.LoginUrl + "?ReturnUrl=" + currentPage;
Response.Redirect(loginUrl);


But this seems ugly.