Question

I am using ASP.NET MVC, on my login action I am doing:

[AcceptVerbs("POST")]
public ActionResult Login(FormCollection form)
{
    User validatedUser = // tests username/pwd here.

    FormsAuthentication.RedirectFromLoginPage(
        validatedUser.ID.ToString(), rememberMe);

    if(String.IsNullOrEmpty(Request["ReturnUrl"]))
        string redirectUrl = Request["ReturnUrl"];

    if (!String.IsNullOrEmpty(Request.QueryString["ReturnUrl"]))
        string redirectUrl = Request["ReturnUrl"];
}

My url looks like this when I am on the login page:

http://localhost:56112/user/login?ReturnUrl=/admin/settings

Does anything look wrong here?

My web.config:

<authentication mode="Forms">
    <forms loginUrl="/user/login"
        protection="All"
        timeout="30"
        name="SomeCookie"
        requireSSL="false"
        slidingExpiration="true"
        defaultUrl="default.aspx" />

Answer 1

I would recommend you against using RedirectFromLoginPage method in an MVC application. It would be better to perform redirects using standard ASP.NET MVC techniques. You may use SetAuthCookie method:

public ActionResult Login(FormCollection form)
{
    // ...
    FormsAuthentication.SetAuthCookie(validatedUser.ID.ToString(), rememberMe);
    // ...
    return Redirect(FormsAuthentication.DefaultUrl); // will read default url from web.config
}