Question

I have a question about the returnUrl querystring parameter that is appended by ASP.Net when attempted to hit a page that requires authentication. In looking at Microsoft NerdDinner Sample’s LogOn action (along with every other ‘sample authentication code’ I see on the ‘net), it just has the ReturnUrl parameter declared in the action’s signature and uses it directly in a Redirect() call. However, back in the WebForms days and using Membership Controls, we use to use the FormsAuthentication.GetReturnUrl() call. Besides returning the ‘default url’ if no url was specified in the querystring, it also does a few security checks (Cross App Redirect and ‘IsDangerousUrl()’). Are those no longer a concern or are all the sample ‘log on’ actions I’m seeing all over the ‘net just ignoring those issues?

Answer 1

I’m not sure about the samples that you’ve looked at, but it’s entirely possibly to use Forms Authentication as is in MVC and benefit from the checks performed in The FormsAuthenticationModule processing (or using the FormsAuthentication class directly).

IIRC, the default MVC application in Visual Studio includes an adapter around forms authentication (AuthenticationService) which can be easily adapted to use the ReturnUrl querystring.

I imagine the samples in question have simply overlooked XSR attacks.