How to mask 'ReturnUrl' in url?

Question

I have a asp.net mvc project and when comming to the loginPage my url looks like:

http://localhost:63356/Account/Login?ReturnUrl=%2F

I don't want it to look like this, and in the routConfig file I've done this:

routes.MapRoute(
   name: "LogIn",
   url: "LogIn",
   defaults: new { controller = "Account", action = "Login" }
);

Which should make the url like this:

http://localhost:63356/Login

What am I missing?

EDIT:

The Login action:

[AllowAnonymous]
public ActionResult Login()
{
  return View();
}

EDIT 2: @pwas mentioned that this is being setup in the view so I altered it by removing the returnUrl paramater:

<section role="main" id="login">
    <div class="panel center-block logInBlock" style="width:300px;">
        <div class="panel-heading loginHeadPadding"><h1>Logga in</h1></div>
        <div class="panel-body loginBodyPadding">

            @using (Html.BeginForm("Login", "Account", new {  }, FormMethod.Post, new { @class = "form-horizontal", role = "form" }))
            {
                @Html.AntiForgeryToken()
                <div class="form-group text-left">
                    @Html.LabelFor(m => m.UserName, "Användarnamn")
                    @Html.TextBoxFor(m => m.UserName, new { @class = "form-control", placeholder = "Användarnamn" })
                </div>
                <div class="form-group text-left">
                    @Html.LabelFor(m => m.Password, "Lösenord")
                    @Html.PasswordFor(m => m.Password, new { @class = "form-control", placeholder = "Lösenord" })
                </div>

                <input type="submit" value="Logga in" class="btn btn-primary btn-block" />

                @Html.ValidationSummary(true, "", new { @class = "text-danger" })
            }
        </div>
    </div>
</section>

Problem still remains

i think you should use Url Patterns https://msdn.microsoft.com/en-us/library/cc668201.aspx?f=255&MSPPError=-2147217396#url_patterns — Alex, Oct 17 '16 at 11:49
That is generated by the the methods in the `AccountController` when you create a new app. Its so that when a user navigates to a method that required authoriation, they are automatically redirected to the login page, and when they submit, are redirected back to the page they were navigating to (in the case of your url, to the `Index()` method of `HomdeController`) — , Oct 17 '16 at 11:49
`%2F` is url encoded. It's decoded bslur id.. '/`.Route has nothing to do with tjat. Check `Url.Action` or `ActionLink` in view that generates this url. — pwas, Oct 17 '16 at 11:49
@Stephen Muecke the 'PreserveLoginUrl' wasn't included in the appsettings and when you say "modify the web.config.cs" in what way do you mean? If you can please provide an answer. — ThunD3eR, Oct 17 '16 at 12:24
What do you mean by "mask", what _do_ you want the URL to look like, and do you want to support returning to the page where Login was clicked? — CodeCaster, Oct 17 '16 at 12:35
What I mean by "masking" it is that I want to hide the controller and action that is being called and also hide the returnUrl paramater. Would like it to look like : "http://localhost:63356/Login". As for the second part of your question Im not sure if I understand what you mean? It is the loginPage, I login and then im inside of the system. The only way back to the logIn page is by logging out. — ThunD3eR, Oct 17 '16 at 12:44

score 1 · Accepted Answer · answered Oct 17 '16 at 12:32

In file Startup.Auth.cs the MVC template probably generated a block like this:

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    // ...
    LoginPath = new PathString("/Account/Login"),
    // ... more ...
});

Change it to this:

    LoginPath = new PathString("/Login"),

then it will work, combined with the route that you had defined already.

To get rid of the ReturnUrl= is a different matter, it is rather forcefully implemented by the ASP.NET authorization mechanism.
You can change the name to e.g. from= by putting this in the above block:

    ReturnUrlParameter = "from",

Setting it to "" does not remove it, just the name that is used will be empty. Also you'll have to make changes in several other places to make sure that the new name is used everywhere.

To remove it entirely there are various guides, but I believe most if not all involve redirecting or URL rewriting.

Thank you! it might not have gotten rid off the retunrUrl paramater but the url is much cleaner. If it is not to much to ask, do you have any of these guides saved somewhere? would be nice to learn. — ThunD3eR, Oct 17 '16 at 12:46
See e.g. this: http://stackoverflow.com/a/35377276/1220550. Another way is to create a new 'dummy' login action method, put its name in `LoginPath=`, and with a body containing just `Return Redirect("~/Login");`. — Peter B, Oct 17 '16 at 13:22

How to mask 'ReturnUrl' in url?

1 Answers1