asp.net mvc 3 - AuthorizeAttribute not working if URL has query string? -

in asp.net mvc3 web application, entire controller has [authorize] attribute attached it. if user not logged in or session expired, redirected login page. working...sometimes. urls in "works" list below correctly redirect login page; urls in "does not work" list instead show iis 401 error screen - not redirect login page.

works

• http://x.y.z/mycontroller/myaction
• http://x.y.z/mycontroller/myaction/123
• http://x.y.z/mycontroller/myaction/123?x=y

does not work

• http://x.y.z/mycontroller/myaction/123?returnurl=
• http://x.y.z/mycontroller/myaction/123?returnurl=xyz

the model myaction action has public string returnurl { get; set; } in base class. has other properties, adding query string not affect login redirection. seems returnurl parameter.

i'm not sure else into. ideas why returnurl parameters causing trouble?

routes

routes.maproute("default-title-id", "{controller}/{action}/{title}_{id}", namespaces); routes.maproute("default-id", "{controller}/{action}/{id}", namespaces); routes.maproute("default", "{controller}/{action}", new { controller = "home", action = "index" }, namespaces); routes.mappageroute("reports-view", "viewreport_{id}", "~/views/reports/view.aspx"); 

working example (well, not working, illustrates problem.)

download solution here: https://docs.google.com/file/d/0b4o6vqgnlpvbevo4bvdkzwfmcee/edit?usp=sharing

and try visit:

• http://your.local.host/test/testme?returnurl= - not redirected login page.
• http://your.local.host/test/testme - will redirected login page.

i wanted post comment, long. needed dynamic redirect 1 of apps, , used following solution (it uses controller called instead of static url in web.config). when testing example, fixes issue. can not figure out why. maybe lead right path or else can clarify.

using system.web.mvc; using system.web.routing;  namespace mvcapplication1.app_start {     public class loginrequiredattribute : authorizeattribute     {         public override void onauthorization(authorizationcontext filtercontext)         {             base.onauthorization(filtercontext);              if (filtercontext.result httpunauthorizedresult)             {                 filtercontext.result = new redirecttorouteresult(new routevaluedictionary                  {                     { "controller", filtercontext.routedata.values[ "controller" ] },                     { "action", "login" },                     { "returnurl", filtercontext.httpcontext.request.rawurl }                 });             }         }     } }  

then change action use new attribute:

[loginrequired] public actionresult testme()