What is ReturnURL in mvc3

Understanding ReturnURL in ASP.NET MVC 3

Explore the purpose and functionality of ReturnURL in ASP.NET MVC 3, a crucial query string parameter for redirecting users after authentication or specific actions.

In ASP.NET MVC 3 applications, you'll frequently encounter the ReturnURL parameter, especially when dealing with authentication and authorization. This query string parameter plays a vital role in user experience by ensuring that after a user completes a necessary action, such as logging in, they are seamlessly redirected back to their original intended destination. Without ReturnURL, users might be dropped onto a generic homepage or a default login success page, disrupting their workflow.

What is ReturnURL?

The ReturnURL is a query string parameter that typically contains the URL of the page the user was trying to access before being redirected to another page (e.g., a login page). Its primary purpose is to provide a mechanism for the application to remember the user's original request and redirect them there once a prerequisite action is completed. This is most commonly seen in authentication scenarios where an unauthenticated user attempts to access a protected resource.

sequenceDiagram
    actor User
    participant Browser
    participant WebApp
    User->>Browser: Tries to access Protected Page
    Browser->>WebApp: GET /ProtectedPage
    WebApp->>WebApp: Checks Authentication
    alt User Not Authenticated
        WebApp-->>Browser: HTTP 302 Redirect to /Account/Login?ReturnURL=/ProtectedPage
        Browser->>WebApp: GET /Account/Login?ReturnURL=/ProtectedPage
        User->>Browser: Enters Credentials
        Browser->>WebApp: POST /Account/Login (with credentials)
        WebApp->>WebApp: Authenticates User
        WebApp-->>Browser: HTTP 302 Redirect to /ProtectedPage
        Browser->>WebApp: GET /ProtectedPage
        WebApp-->>Browser: Renders Protected Page
    else User Authenticated
        WebApp-->>Browser: Renders Protected Page
    end

Sequence diagram illustrating the ReturnURL flow during authentication.

How ReturnURL is Used in MVC 3

In ASP.NET MVC 3, the ReturnURL parameter is often automatically handled by the built-in authentication mechanisms, particularly with FormsAuthentication. When an unauthenticated user tries to access an action method decorated with the [Authorize] attribute, the framework intercepts the request and redirects the user to the login page. During this redirection, the original URL is appended as the ReturnURL query string parameter.

After successful authentication, the login action method (or the FormsAuthentication system itself) checks for the presence of ReturnURL. If found, it uses this URL to redirect the user back to their intended destination. If ReturnURL is not present, the user is typically redirected to a default page, such as the application's home page.

public ActionResult Login(string returnUrl)
{
    ViewBag.ReturnUrl = returnUrl;
    return View();
}

[HttpPost]
public ActionResult Login(LoginModel model, string returnUrl)
{
    if (ModelState.IsValid && Membership.ValidateUser(model.UserName, model.Password))
    {
        FormsAuthentication.SetAuthCookie(model.UserName, model.RememberMe);
        if (Url.IsLocalUrl(returnUrl))
        {
            return Redirect(returnUrl);
        }
        else
        {
            return RedirectToAction("Index", "Home");
        }
    }

    // If we got this far, something failed, redisplay form
    ModelState.AddModelError("", "The user name or password provided is incorrect.");
    return View(model);
}

Example of a Login action method handling ReturnURL in MVC 3.

Customizing ReturnURL Behavior

While FormsAuthentication handles ReturnURL automatically for authorization, you might also want to use this pattern for other scenarios, such as after a user completes a profile update, a purchase, or any other action where they should be returned to a specific previous page. You can manually construct URLs with ReturnURL or pass it between actions using TempData or session state, though query string is the most common and explicit method.

// Manually generating a ReturnURL for a custom action
public ActionResult EditProfile()
{
    // ... logic ...
    return View();
}

[HttpPost]
public ActionResult EditProfile(ProfileModel model)
{
    if (ModelState.IsValid)
    {
        // Save profile changes
        // ...

        // Redirect back to the page that initiated the profile edit
        string returnUrl = Request.QueryString["ReturnURL"];
        if (Url.IsLocalUrl(returnUrl))
        {
            return Redirect(returnUrl);
        }
        else
        {
            return RedirectToAction("Dashboard", "User"); // Default redirect
        }
    }
    return View(model);
}

Using ReturnURL for a custom action like profile editing.