0

Here's a head-scratcher:

I have a Dotnet Application which signs a user out after a certain inactive time period. A JavaScript function using an action defined in the relevant CSHTML sends the user to a certain controller method which will sign them out.

When the JavaScript code decides that the user should be signed out, it uses the following line to do so:

location.href = settings.actions.expireSession + '?returnUrlString=' + currentUrl;

where settings.actions.expireSession is defined as:

expireSession: '@Url.Action("Expire", "Session")'

and the return url string getting into the location.href looks like this:

http://localhost:49574/Report/ReportWithUserIdAndCaseId?userId=84&caseId=173

which is correct, and the entire string assembled together with the url action looks like this:

"/Session/Expire?returnUrlString=http://localhost:49574/Report/ReportWithUserIdAndCaseId?userId=84&caseId=173"

I set up a breakpoint at the point of entry in the relevant method, but what arrives in the string parameter named "returnUrlString" there is missing the "caseId":

http://localhost:49574/?returnUrl=http%3A%2F%2Flocalhost%3A49574%2FReport%2FReportWithUserIdAndCaseId%3FuserId%3D84

consequently, when I enter my username and password to log back in, I get redirected to the following url:

http://localhost:49574/Report/EntrySummaryReportWithPatientIdAndVisitId?userId=84

which fails because it's missing a crucial parameter.

Have I missed anything obvious? Is there something else in the automated background of Dotnet's addressing/redirection system that could be contributing to this mysterious disappearance?

A huge thanks to everyone for reading this, and a gargantuan thanks for contributors! - Ilia

justian17
  • 575
  • 1
  • 7
  • 17

1 Answers1

1

You need to escape the Url before it is sent to the Session/Expire page.

See this previous question for information on encoding it in Javascript: Encode URL in JavaScript?

Once you have returnUrlString on your Session Expire page, you should then unescape it and direct the user to it.

The problem is that the Url to the Session/Expire page would be: "/Session/Expire?returnUrlString=http://localhost:49574/Report/ReportWithUserIdAndCaseId?userId=84&caseId=173"

What the server sees is: Page: "/Session/Expire?, QueryString ReturnUrlString: returnUrlString=http://localhost:49574/Report/ReportWithUserIdAndCaseId?userId=84, QueryString CaseId: &caseId=173"

It is interpreting your &caseId as part of the /Session/Expire URL. This is why it disappears.

Community
  • 1
  • 1
Der Kommissar
  • 5,848
  • 1
  • 29
  • 43
  • Thank you, Kind sir. That is what it was. For the record, I tried "encodeURI(uri)" and that failed.What worked was "encodeURIComponent(uri)". – justian17 Mar 03 '15 at 15:46
  • It tends to differ based on what you want to do with it, glad this resolved your problem. – Der Kommissar Mar 03 '15 at 15:55