0

I have built a ASP.NET CORE MVC application and use cookie authentication. Below is my code in Startup.cs file.

services.AddAuthentication(options =>
{
    // these must be set other ASP.NET Core will throw exception that no
    // default authentication scheme or default challenge scheme is set.
    options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
})
  .AddCookie(options =>
   {
       options.LoginPath = "/Account/Login/";
   });

When the cookie expires, application redirects to the /Account/Login path with a Return Url containing the current url the user was in. This works fine until the current url has 0 or 1 query parameters. If the current url has 2 query paramaters then only the first query parameter is passed to the return URL. The Login method is as below.

public IActionResult Login(string returnUrl)
{
   return View(new LogInViewModel { ReturnUrl = returnUrl });
}

e.g. If the current URL is /Inspection?inspectionID=1&processTypeID=2 then the return url gets only /Inspection?inspectionID=1. The processtypeID parameter is not coming.

But when the browser is navigated to the /Account/Login URL when the cookie is expired, it shows the correct url /Account/Login?ReturnUrl=/Inspection?inspectionID=1&processTypeID=2

Can anyone point me why this is occurring and how to fix this?

Thanks, Zehan

Gergely Bakos
  • 90
  • 2
  • 5
Zehan Jurangpathy
  • 45
  • 8

1 Answers1

1

Encoding the the value of the redirect uri solved it for me.

In my case I had a blazor page with:

<a href="auth/Signin?redirectUri=@RedirectUri">Sign In</a>

where RedirectUri returns the full current page path, including multiple query parameters.

I changed the link to:

<a href="auth/Signin?redirectUri=@UrlEncode(RedirectUri)">Sign In</a>, the key being UrlEncode(RedirectUri), which solved the problem for me.

UrlEncode can be found on the namespace System.Web.HttpUtility.

rjb
  • 113
  • 1
  • 6