MVC :: Passing ReturnURL Through Authorization?
Dec 16, 2010
I am creating MVC e-commerce website.
There is an "Add to Cart" button on product detail page, and If I click the button, it should be directed to login page.
After I login, it should be re-directed to the product detail page.
"Add to Cart" button is a CartConroller action.
In CartController.cs :
[Code]....
In AccountController.cs :
[Code]....
the product should not be added into the cart before login, so I put [Authorize] on AddToCart action.
however if I click the "add to cart" button, it directs to the login page, and if I login, it gives me an error because it lost all the AddToCart action's parameter information(e.g. Cart cart, int productId, string returnURL)
View 3 Replies
Similar Messages:
Mar 29, 2011
I am using ASP.NET MVC 3 and am trying to do something that should be really straight forward...
My application uses Forms authentication and that is working perfectly for controllers/actions. For example if I decorate either a controller or an action with the attribute below only members of the administrators group can view them:
[Authorize(Roles="Administrators")]
However I have a folder under the default Scripts folder called Admin. I only want members of the Administrators group to be able to access scripts within this directory so I created a new web.config in the directory with the following inside:
[code]....
However no matter whether a user is a member of the Administrators group or not they receive a 302 Found message and are then redirected to the login page.
If I change the web.config to allow user="*" then it works. It also works if I add an allow users="Username" for a specific user I am testing with.
View 1 Replies
Jun 28, 2010
When a user attempts to directly visit the url admin.aspx, and they are not an admin, they are redirected to the login page. However, the user then attempts to visit ViewWeek.aspx, it indicates that they are still logged in. Why does this ASP.NET authorization boot the user to the login screen, yet keep the user logged in? I'd rather it just direct the user to the default URL specified in the forms tag.
Here's my Forms Authentication:
<authentication mode="Forms">
<forms name=".ASPXFORMSAUTH" defaultUrl="ViewWeek.aspx" timeout="50000000" />
</authentication>
View 1 Replies
Apr 26, 2010
Our team has recently implemented a role permission based authorization so that we can have granular control. This is similar to what Rockford Lhotka suggests herehttp://www.lhotka.net/weblog/PermissionbasedAuthorizationVsRolebasedAuthorization.aspx I have also read about the Claims based authorization which to me looks very similar to what we have. Can some one put in simple terms what the advantages of claims based authorization are.
View 1 Replies
Jun 16, 2010
MVC has a method LogOn in AccountControllers. It has parameter returnUrl to redirect after login. I used this method to redirect to login page and back to previous page after logined by returnUrl parameter.My code in form view
<%= Html.ActionLink("sign in", "LogOn", "Account", new { returnUrl = Request.RawUrl })%>
But it doesn't work
View 2 Replies
Sep 15, 2010
I want to remove "returnurl=/blabla" from address bar when a user want to access to a login required page. Because I'm trying to redirect the user to a static page after login to do some selections.
View 4 Replies
Jan 26, 2011
Is it possible clear ReturnUrl from the server? I have a login page where the user logouts and I want to direct them to a specific page but when ReturnURL is set it overrides my redirect page.
Update:Ideally, I will only redirect a user who has just logged out versus someone who has bookmarked OR I will redirect regardless in special cases.So these are the cases:A link or bookmark -> should redirect to specified page in most case.A logout that has a returnurl -> should NOT redirect to the page,A special case -> should always redirect to my special case, i.e when a user needs to see something important
Is there a way to remove the returnurl from the logout/login status control?
View 2 Replies
Dec 16, 2010
my AccountController has this action :
[Code]....
currently, if the login succeds, it redirects to the homepage, but i want to redirect to the string returnURL.
View 2 Replies
Apr 8, 2010
For a testproject I use two Login pages. I order to do that I use a dispatcher page:
Dispatcher:
[Code]....
I then just redirect in the dispatcher to the real login-page according to the ReturnUrl. So far so good. The only problem I have is that I don't get redirected to the ReturnUrl once I'm logged in... Of course I add the ReturnUrl to the forwarded Login-Page (/Admin/Login.aspx?ReturnUrl=...).
View 5 Replies
Apr 4, 2011
I have such URL
localhost/Login/LogOn?ReturnUrl=/#&q=my%20search%20word&f=1//447044365|2//4
I need to get hash parameters to navigate in the application after authentication.
I try to catch it like this
<input name="returnUrl" value="<%= ViewContext.HttpContext.Request.Url.PathAndQuery %>" type="hidden" />
But result is
/Login/LogOn?ReturnUrl=/
I tried to take away "/#" in the URL, then I get whole URL. But I need to use this URL as it is.
View 1 Replies
Aug 24, 2010
I'm building my asp.net 4.0 website with url routing. It works great, except that I have stumbled upon one problem. The problem is that when a logged in user is on one of the non-public pages and gets loged out, the return url is set to the page he or she was previously visiting. When logging in again, the ReturnUrl is non routed url (something like login.aspx?ReturnUrl=somethingsomething). This poses a problem for some of my pages where I have a default value stored in the route; it simply doesn't get picked up with the non routed url of the ReturnUrl.The result is a broken page (404).
View 2 Replies
May 28, 2010
I am writing an application with UrlRewriter.net and I would like it to be able to redirect from login pages to ReturnUrl's.
What I would like to do is something on the lines of http://www.website.com/loginpage/[EncodedURL] but when I try it, it says "Bad Request".]
View 2 Replies
Mar 30, 2010
I am having an endless problem with the following.When a user logs in I want him directed to a spesific page an not the ReturnURL. How do I enforce this?I am coding in C#
View 1 Replies
Feb 19, 2010
I'm using ASP.NET Membership and Form Authentication and before redirecting to the returnURL I wanted to validate it. For those unfamiliar with the workflow, basically if you request a page that requires that you are authenticated, you are redirected to a login page. In the URL string you'll see a parameter called returnURL, e.g. [URL]
Whether you use this in a redirect such as Response.Redirect(returnURL) or indirectly through the FormsAuthentication.RedirectFromLoginPage method, it passes without validating returnURL.
FormsAuthentication.RedirectFromLoginPage does have a security check that it is isn't leaving the domain, but that still doesn't stop someone from putting enough random characters to cause an error.
I tried using System.IO.File.Exists(Server.MapPath(returnURL)) but given enough illegal characters it cause Server.MapPath to error.
Note: URLEncoding doesn't work because we are not cleaning a parameter, but the primary URL.
View 1 Replies
Sep 16, 2010
I'm having trouble with the ReturnUrl property using forms authentication. If my URL is [URL], the ReturnURL value in the querystring is ignored and it always sends me to the defaultUrl value default.aspx.
login.aspx:
FormsAuthentication.RedirectFromLoginPage(txtEmail.Text, chkRememberMe.Checked)
web.config:
<system.web>
<authentication mode="Forms">
<forms loginUrl="login.aspx"
protection="All"
timeout="30"
name=".ASPXAUTH"
path="/"
requireSSL="false"
slidingExpiration="true"
defaultUrl="default.aspx"
cookieless="UseDeviceProfile"
enableCrossAppRedirects="false" />
</authentication>
<authorization>
<deny users="?" />
</authorization>
View 1 Replies
Oct 21, 2010
I've got a couple pages in my web app that are used by external applications. They will link to the pages, and pass in various querystring values to allow my app to do the searching and return the results in the page. The problem is, if the user is not yet logged into the web app, they are sent to the login page, and the ReturnURL is truncated to include only the first QueryString value. I lose the rest of the values. So far I haven't figured out a solution to this. Here's a quick example:
The external application links the user to:
[URL]
If the user is not logged in they are sent to the login page, and the current URL looks like this:
[URL]
View 4 Replies
Dec 29, 2010
I am trying to redirect the user to login page with ReturnUrl and with querystring parameters which are already in the url there.But it is getting only first querystring parameter and not others. here is the code:Response.Redirect("~/login.aspx?ReturnUrl="+Request.RawUrl);it is showing correct in login.aspx after redirect but not returning as per querystring parametersI ave also tried other methods e.g.:
Response.Redirect("~/login.aspx?ReturnUrl="+Request.AppRelativeCurrentExecutionFilePath+"?"+Request.QueryString);
View 2 Replies
Apr 27, 2010
i have created a page ate.aspx in a folder ate_secure in default directory http://localhost/. when i try to open ate.aspx, it redirects me to login.aspx, thats ok, but when i fill user name and pass and press login button, it doesn't redirect me to ate.aspx and remains at the login page with no error and all fields blank. everything was working fine till my login page ate.aspx were in the same default directory. but i wanted to use role management so i created a folder ate_secure and put ate.aspx into this folder,
View 4 Replies
Feb 23, 2011
In my app, I use the built-in membership for managing security. If I log into my app using my iPad or iPhone, I see some long string preceding the ReturnUrl. Here's an example of what it looks like: [URL] At that point, I'm at where I wanted to go but I'm logged off. If I try to go to another secure page, I have to log in again. And the cycle starts all over again.
View 2 Replies
Feb 11, 2011
[Code]....
MyDomain.com. But ReturnUrl has value
[Code]....
View 1 Replies
Feb 2, 2011
I have a website hosted on IIS7 with the url rewrite module 2.0 installed. It is run by content management that looks at the url and returns a 401 error if the current user does not have permission to view the page. This gets picked up by the asp.net url authorization module which then kicks the page over to the loginUrl page as specified in the web.config (forms authentication).
This works perfectly on my local machine - which is IIS7 and windows7.
If the url is, say, /612/some-string the user gets directed to the login page at /66/login?ReturnUrl=/612/some-string
The url rewriting looks at the first part of the url for the document id. The real url would be this: index.aspx?documentId=612
Unfortunately, when I deployed this to our staging server, the ReturnUrl isn't the rewritten url, it's the original url. This causes all sorts of problems.
The staging server is also IIS7 with the url rewrite module 2.0 installed. It's Windows 2008 server SP2. Both are running asp.net 3.5.
My only guess is that the machine.config orders the default httpModules differently, and the .net forms authentication module is jumping in before the url has been rewritten.
I'll review that soon, but in the meantime has anyone experienced this problem and solved it?
Update
I also tried changing
Response.StatusCode = 401;
to
FormsAuthentication.RedirectToLoginPage();
Which gets me a bit ahead, but still directs the user back to the url that hasn't been rewritten.
I can also do this instead of setting the 401:
string currentPage = HttpUtility.UrlEncode(Request.RawUrl);
string loginUrl = FormsAuthentication.LoginUrl + "?ReturnUrl=" + currentPage;
Response.Redirect(loginUrl);
But this seems ugly.
View 1 Replies
Jan 20, 2010
I have a loginStatus control, if user click "Login", it will go to the login page, and usually followed by "ReturnUrl": for example:
Before I hit the "Login", the page is:
[URL]
After I click the "Login", the URL is:
[URL]
As you can see the parameter value 1008 is gone. Have searched for a while, one article mentioned:
"ASP.NET's login controls use a ReturnUrl, but don't keep the parameters in this URL".
How can i keep the id number (1008) in the ReturnURL? or have other way to get around this? can I write my own returnURL? say once user clicks the "Login", I create my own return url, myReturnURL=ReturnUrl=/Books/CodeInBooks.aspx?id=1008
View 2 Replies
Oct 12, 2010
With Forms Authentication when the app needs to redirect to sign-in page is there an event or any extensibility point that will let me do additional work to the request before it redirects to the sign-in page?
I would like to send additional information in the query string that could vary such that it wouldn't work to just statically embed that in the link in the loginUrl node in the web.config.
Edit: For clarification, I want to intercept the request prior to being redirected TO the login page.
Example:
<authentication mode="Forms">
<forms loginUrl="http://the/interwebs/login.aspx" timeout="2880"
enableCrossAppRedirects="true" />
</authentication>
And prior the user being redirected to http://the/interwebs/login.aspx I would like to be able to pack in query values so the url could end up something like http://the/interwebs/login.aspx?Action=Refresh
View 3 Replies
Jan 29, 2010
(This is a more narrow question)
In my asp.net MVC action, I am looking if the ReturnUrl value is in the URL.
My Url looks like this:
[URL]
In my action, I am looking if that querystring value exists, and it is returning NULL?? How can this be?
The code:
if(Request.QueryString["ReturnUrl"] != null)
{
}
Tracing through the application, it is just skipping the if statement's body i.e. it is NULL.
How can this be explained?
[URL]
View 2 Replies
Feb 23, 2010
I've an Admin area and I want only Admins to enter the area. I considered adding the Authorized attribute to every controller in the Admin area. Isn't there an elegant solution or is this feature not there in the framework itself?
EDIT:
I should to have mentioned this before. I'm using a custom AuthorizedAttribute derived from AuthorizeAttribute.
View 3 Replies
