Question

We’re building an application that is a Silverlight client application, but we’ve created an MVC controller and a few simple views to handle authentication and hosting of the Silverlight control for this application. As part of the security implementation, I’ve created a custom Authorization filter attribute to handle this, but am getting some unexpected results trying to properly handle redirection after authentication.

For example, our Silverlight application’s navigation framework allows users to deep-link to individual pages within the application itself, such as http://myapplicaton.com/#/Product/171. What I want, is to be able to force a user to login to view this page, but then successfully redirect them back to it after successful authentication. My problem is with getting the full, requested URL to redirect the user to from within my custom authorization filter attribute class.

This is what my attribute code looks like:

public class RequiresAuthenticationAttribute : FilterAttribute, IAuthorizationFilter
{
    protected bool AuthorizeCore(HttpContextBase httpContext)
    {
        var cookie = Cookie.Get(SilverlightApplication.Name);

        if (SilverlightApplication.RequiresLogin)
        {
            return 
                ((cookie == null) ||
                 (cookie["Username"] != httpContext.User.Identity.Name) ||
                 (cookie["ApplicationName"] != SilverlightApplication.Name) ||
                 (Convert.ToDateTime(cookie["Timeout"]) >= DateTime.Now));
        }
        else
            return false;
    }

    public void OnAuthorization(AuthorizationContext filterContext)
    {
        if (filterContext != null && AuthorizeCore(filterContext.HttpContext))
        {
            var redirectPath = "~/login{0}";
            var returnUrl = filterContext.HttpContext.Request.RawUrl;
            if (string.IsNullOrEmpty(returnUrl) || returnUrl == "/")
                redirectPath = string.Format(redirectPath, string.Empty);
            else
                redirectPath = string.Format(redirectPath, string.Format("?returnUrl={0}", returnUrl));

            filterContext.Result = new RedirectResult(redirectPath);
        }
    }
}

So in this case, if I browse directly to http://myapplicaton.com/#/Product/171, in the OnAuthorize method, where I’m grabbing the filterContext.HttpContext.Request.RawUrl property, I would expect it’s value to be “/#/Product/171”, but it’s not. It’s always just “/”. Does that property not include page level links? Am I missing something?

Answer 1

The # sign in URLs (also called the fragment part of an URL) is only used by browsers to navigate between history and links. Everything following this sign is never sent to the server and there’s no way to get it in a server side script.