Url Redirection

[Nick]

Hi there,

I'm passing an HTML encoded string to an URL in the query parameter.
This query string works perfect in the website if you are already logged on,
if you are not logged on the application calls
FormsAuthentica tion.RedirectTo LoginPage() then the URL becomes malformed.

I then recieve the following error,

"The return URL specified for request redirection is invalid."

for example

?inputfile=F:%5 CFacebook%5CDoc uments%5CDocume nts%5CUser's%20 Guide.doc

then becomes

?ReturnUrl=%2fD SP%2fsecure%2fd efault.aspx%3fi nputfile%3dF%3a %255CFacebook%2 55CDocuments%25 5CDocuments%255 CUser's%2520Gui de.doc&inputfil e=F:%5CFacebook %5CDocuments%5C Documents%5CUse r's%20Guide.doc

Which is rather screwed. Any ideas how how I can work around this?

Thanks a million for your time in advance.

Nick.

[Marc]

"Nick" <[e-mail] in message
news:et******** ******@TK2MSFTN GP06.phx.gbl...

Hi there,

I'm passing an HTML encoded string to an URL in the query parameter.
This query string works perfect in the website if you are already logged
on,

Try UrlEncode instead of HtmlEncode.

[Steven Cheng [MSFT]]

Hi Nick,

As Marc has suggested, you can try using UrlEncode since that will make
sure the output characters are valid and safe one in http url string.
Generally if you have multiple querystring parameters, it should be
separated via "&" char.

BTW, why are you using querystring to store large data as querystring has
length limitation, is there any paritcular requirement here? You can
provide some further info about the application code logic or requirement
so that we can look for any other potential solutions.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead
Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
ms****@microsof t.com.

=============== =============== =============== =====
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications.

=============== =============== =============== =====
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------

>From: "Nick" <[e-mail]>
Subject: Url Redirection
Date: Fri, 25 Jul 2008 16:31:31 +0100

>
Hi there,

I'm passing an HTML encoded string to an URL in the query parameter.
This query string works perfect in the website if you are already logged

on,

>if you are not logged on the application calls
FormsAuthentic ation.RedirectT oLoginPage() then the URL becomes malformed.

I then recieve the following error,

"The return URL specified for request redirection is invalid."

for example

?inputfile=F:%5 CFacebook%5CDoc uments%5CDocume nts%5CUser's%20 Guide.doc

then becomes

?ReturnUrl=%2fD SP%2fsecure%2fd efault.aspx%3fi nputfile%3dF%3a %255CFacebook%2 5
5CDocuments%255 CDocuments%255C User's%2520Guid e.doc&inputfile =F:%5CFacebook% 5
CDocuments%5CDo cuments%5CUser' s%20Guide.doc

>
Which is rather screwed. Any ideas how how I can work around this?

Thanks a million for your time in advance.

Nick.

[Nick]

Hi Marc,

Sorry what I meant to say was I am using the UrlEscape method in a C++
application that is invoking the url.

http://msdn.microsoft.com/en-us/libr...74(VS.85).aspx

Nick.

"Marc " <Rm********@ima rc.co.ukwrote in message
news:uu******** ******@TK2MSFTN GP06.phx.gbl...

"Nick" <[e-mail] in message
news:et******** ******@TK2MSFTN GP06.phx.gbl...

>Hi there,

I'm passing an HTML encoded string to an URL in the query parameter.
This query string works perfect in the website if you are already logged
on,

Try UrlEncode instead of HtmlEncode.

[Nick]

Hi Steven,

I wouldn't say that a 256 character max path is too long for an URL
surely?

It needs to be invoked this way unfortunately as it's being called via
an add-in for another application.

I got the name of the method I am using incorrectly, it is UrlEncode,

http://msdn.microsoft.com/en-us/libr...74(VS.85).aspx

Basically what is happening is the query is being re-escaped when the
server bounces it so it's escaping the escape characters.

Surely if the URL is working before being bounced, then it is not badly
formed?

Nick.

"Steven Cheng [MSFT]" <st*****@online .microsoft.comw rote in message
news:Qm******** ********@TK2MSF TNGHUB02.phx.gb l...

Hi Nick,

As Marc has suggested, you can try using UrlEncode since that will make
sure the output characters are valid and safe one in http url string.
Generally if you have multiple querystring parameters, it should be
separated via "&" char.

BTW, why are you using querystring to store large data as querystring has
length limitation, is there any paritcular requirement here? You can
provide some further info about the application code logic or requirement
so that we can look for any other potential solutions.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead
Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
ms****@microsof t.com.

=============== =============== =============== =====
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications.

=============== =============== =============== =====
This posting is provided "AS IS" with no warranties, and confers no
rights.
--------------------

>>From: "Nick" <[e-mail]>
Subject: Url Redirection
Date: Fri, 25 Jul 2008 16:31:31 +0100

>>
Hi there,

I'm passing an HTML encoded string to an URL in the query parameter.
This query string works perfect in the website if you are already logged

on,

>>if you are not logged on the application calls
FormsAuthenti cation.Redirect ToLoginPage() then the URL becomes malformed.

I then recieve the following error,

"The return URL specified for request redirection is invalid."

for example

?inputfile=F:%5 CFacebook%5CDoc uments%5CDocume nts%5CUser's%20 Guide.doc

then becomes

?ReturnUrl=%2fD SP%2fsecure%2fd efault.aspx%3fi nputfile%3dF%3a %255CFacebook%2 5
5CDocuments%255 CDocuments%255C User's%2520Guid e.doc&inputfile =F:%5CFacebook% 5
CDocuments%5CDo cuments%5CUser' s%20Guide.doc

>>
Which is rather screwed. Any ideas how how I can work around this?

Thanks a million for your time in advance.

Nick.

[Steven Cheng [MSFT]]

Thanks for the followup Nick,

Would you post some of your page's code such as how to concatenate the
querystring (just the code snippet that is sufficient to repro the
behavior)? I'd like to have a test on my side.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead
Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
ms****@microsof t.com.

=============== =============== =============== =====
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications.

=============== =============== =============== =====
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------

>From: "Nick" <[e-mail]>
References: <et************ **@TK2MSFTNGP06 .phx.gbl>

<Qm************ **@TK2MSFTNGHUB 02.phx.gbl>

>Subject: Re: Url Redirection
Date: Wed, 30 Jul 2008 13:53:40 +0100

>
Hi Steven,

I wouldn't say that a 256 character max path is too long for an URL
surely?

It needs to be invoked this way unfortunately as it's being called via
an add-in for another application.

I got the name of the method I am using incorrectly, it is UrlEncode,

http://msdn.microsoft.com/en-us/libr...74(VS.85).aspx

Basically what is happening is the query is being re-escaped when the
server bounces it so it's escaping the escape characters.

Surely if the URL is working before being bounced, then it is not

badly

>formed?

Nick.

"Stev

[Nick]

Hi Steven,

Sure no probs, the code that I'm using to create the URL is,

----

HRESULT hr;
TCHAR* pChrFileName = pStrFileName.Ge tBuffer();
DWORD pDWdSize = INTERNET_MAX_UR L_LENGTH;
TCHAR* pChrEncoded = (TCHAR*)calloc( pDWdSize, sizeof(TCHAR));
ZeroMemory(pChr Encoded, pDWdSize);
UrlEscape(pChrF ileName, pChrEncoded, &pDWdSize, NULL);
pStrFileName.Re leaseBuffer(0);
CString pStrEncoded = pChrEncoded;
free(pChrEncode d);

CString pStrURL = _T("http://www.myurl.com/default.aspx?in putfile=");
pStrURL += pStrEncoded;
CString pStrParams = _T("url.dll,Fil eProtocolHandle r ");
pStrParams += pStrURL;

----

pStrParams is then fired off to ShellExecuteEx which correctly opens the
URL in the default web browser.

Nick.

"Steven Cheng [MSFT]" <st*****@online .microsoft.comw rote in message
news:w%******** ********@TK2MSF TNGHUB02.phx.gb l...

Thanks for the followup Nick,

Would you post some of your page's code such as how to concatenate the
querystring (just the code snippet that is sufficient to repro the
behavior)? I'd like to have a test on my side.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead
Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
ms****@microsof t.com.

=============== =============== =============== =====
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications.

=============== =============== =============== =====
This posting is provided "AS IS" with no warranties, and confers no
rights.

--------------------

>>From: "Nick" <[e-mail]>
References: <et************ **@TK2MSFTNGP06 .phx.gbl>

<Qm************ **@TK2MSFTNGHUB 02.phx.gbl>

>>Subject: Re: Url Redirection
Date: Wed, 30 Jul 2008 13:53:40 +0100

>>
Hi Steven,

I wouldn't say that a 256 character max path is too long for an URL
surely?

It needs to be invoked this way unfortunately as it's being called via
an add-in for another application.

I got the name of the method I am using incorrectly, it is UrlEncode,

http://msdn.microsoft.com/en-us/libr...74(VS.85).aspx

Basically what is happening is the query is being re-escaped when the
server bounces it so it's escaping the escape characters.

Surely if the URL is working before being bounced, then it is not

badly

>>formed?

Nick.

"Stev

[Steven Cheng [MSFT]]

Thanks for the reply Nick,

I haven't expected that the client code is for unmanaged cpp. Have you
tried some .NET based webrequest or webbrowser control based code to see
whether it can repro the same behavior?

Sincerely,

Steven Cheng
Microsoft MSDN Online Support Lead
Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
ms****@microsof t.com.

=============== =============== =============== =====
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications.

=============== =============== =============== =====
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------

>From: "Nick" <[e-mail]>
Subject: Re: Url Redirection
Date: Thu, 31 Jul 2008 09:21:23 +0100

>
Hi Steven,

Sure no probs, the code that I'm using to create the URL is,

----

HRESULT hr;
TCHAR* pChrFileName = pStrFileName.Ge tBuffer();
DWORD pDWdSize = INTERNET_MAX_UR L_LENGTH;
TCHAR* pChrEncoded = (TCHAR*)calloc( pDWdSize, sizeof(TCHAR));
ZeroMemory(pChr Encoded, pDWdSize);
UrlEscape(pChrF ileName, pChrEncoded, &pDWdSize, NULL);
pStrFileName.Re leaseBuffer(0);
CString pStrEncoded = pChrEncoded;
free(pChrEncode d);

CString pStrURL = _T("http://www.myurl.com/default.aspx?in putfile=");
pStrURL += pStrEncoded;
CString pStrParams = _T("url.dll,Fil eProtocolHandle r ");
pStrParams += pStrURL;

----

pStrParams is then fired off to ShellExecuteEx which correctly opens

the

>URL in the default web browser.

Nick.

"Steven Cheng [MSFT]" <st*****@online .microsoft.comw rote in message
news:w%******* *********@TK2MS FTNGHUB02.phx.g bl...

>Thanks for the followup Nick,

Would you post some of your page's code such as how to concatenate the
querystring (just the code snippet that is sufficient to repro the
behavior)? I'd like to have a test on my side.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead
Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you.

Please

>feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
ms****@microsof t.com.

============== =============== =============== ======
Get notification to my posts through email? Please refer to

http://msdn.microsoft.com/subscripti...ult.aspx#notif

>ications.

============== =============== =============== ======
This posting is provided "AS IS" with no warranties, and confers no
rights.

--------------------

>>>From: "Nick" <[e-mail]>
References : <et************ **@TK2MSFTNGP06 .phx.gbl>

<Qm*********** ***@TK2MSFTNGHU B02.phx.gbl>

>>>Subject: Re: Url Redirection
Date: Wed, 30 Jul 2008 13:53:40 +0100

>>>
Hi Steven,

I wouldn't say that a 256 character max path is too long for an URL
surely?

It needs to be invoked this way unfortunately as it's being called

via

>>>an add-in for another application.

I got the name of the method I am using incorrectly, it is UrlEncode,

http://msdn.microsoft.com/en-us/libr...74(VS.85).aspx

Basically what is happening is the query is being re-escaped when the
server bounces it so it's escaping the escape characters.

Surely if the URL is working before being bounced, then it is not

badly

>>>formed?

Nick.

"Stev

[Nick]

Hi Steven,

Indeed, it's part of an unmanaged addin for another application and
invoking via the shell is the most efficient way of achieving the desired
result as the browser will need to be opened if it isn't already.

I don't seem to have any control over this as it's all handled
internally and controlled via the web.config file afaik. So here is my
current thoughts...

1. The URL is created and escaped correctly.
2. The URL works on the site if logged in already
3. If not logged in ASP.NET screws with the URL and makes it invalid
then kicks you back to the login page.

So using my advanced powers of deduction. asp.net is screwing with my
query string and making it unusable? Therefore I can't see how this can be
worked around unless I can modify the query string during this process but
unfortunately none of my code is hit in page load for me to be able to. Or
am I able to perform the bounce manually somehow?

Thanks for your time again!

Nick.

"Steven Cheng [MSFT]" <st*****@online .microsoft.comw rote in message
news:iA******** ******@TK2MSFTN GHUB02.phx.gbl. ..

Thanks for the reply Nick,

I haven't expected that the client code is for unmanaged cpp. Have you
tried some .NET based webrequest or webbrowser control based code to see
whether it can repro the same behavior?

Sincerely,

Steven Cheng
Microsoft MSDN Online Support Lead
Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
ms****@microsof t.com.

=============== =============== =============== =====
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications.

=============== =============== =============== =====
This posting is provided "AS IS" with no warranties, and confers no
rights.
--------------------

>>From: "Nick" <[e-mail]>
Subject: Re: Url Redirection
Date: Thu, 31 Jul 2008 09:21:23 +0100

>>
Hi Steven,

Sure no probs, the code that I'm using to create the URL is,

----

HRESULT hr;
TCHAR* pChrFileName = pStrFileName.Ge tBuffer();
DWORD pDWdSize = INTERNET_MAX_UR L_LENGTH;
TCHAR* pChrEncoded = (TCHAR*)calloc( pDWdSize, sizeof(TCHAR));
ZeroMemory(pChr Encoded, pDWdSize);
UrlEscape(pChrF ileName, pChrEncoded, &pDWdSize, NULL);
pStrFileName.Re leaseBuffer(0);
CString pStrEncoded = pChrEncoded;
free(pChrEncode d);

CString pStrURL = _T("http://www.myurl.com/default.aspx?in putfile=");
pStrURL += pStrEncoded;
CString pStrParams = _T("url.dll,Fil eProtocolHandle r ");
pStrParams += pStrURL;

----

pStrParams is then fired off to ShellExecuteEx which correctly opens

the

>>URL in the default web browser.

Nick.

"Steven Cheng [MSFT]" <st*****@online .microsoft.comw rote in message
news:w%****** **********@TK2M SFTNGHUB02.phx. gbl...

>>Thanks for the followup Nick,

Would you post some of your page's code such as how to concatenate the
querystring (just the code snippet that is sufficient to repro the
behavior)? I'd like to have a test on my side.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead
Delighting our customers is our #1 priority. We welcome your comments
and
suggestions about how we can improve the support we provide to you.

Please

>>feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
ms****@microsof t.com.

============= =============== =============== =======
Get notification to my posts through email? Please refer to

http://msdn.microsoft.com/subscripti...ult.aspx#notif

>>ications.

============= =============== =============== =======
This posting is provided "AS IS" with no warranties, and confers no
rights.

--------------------
From: "Nick" <[e-mail]>
Reference s: <et************ **@TK2MSFTNGP06 .phx.gbl>
<Qm********** ****@TK2MSFTNGH UB02.phx.gbl>
Subject: Re: Url Redirection
Date: Wed, 30 Jul 2008 13:53:40 +0100
Hi Steven,

I wouldn't say that a 256 character max path is too long for an URL
surely?

It needs to be invoked this way unfortunately as it's being called

via

>>>>an add-in for another application.

I got the name of the method I am using incorrectly, it is
UrlEncode,

http://msdn.microsoft.com/en-us/libr...74(VS.85).aspx

Basically what is happening is the query is being re-escaped when
the
server bounces it so it's escaping the escape characters.

Surely if the URL is working before being bounced, then it is not
badly
formed?

Nick.

"Stev

[Steven Cheng [MSFT]]

Thanks for your reply Nick,

For this case, since the server-side has forms authentication to protect
the page. How about this;

1 for your add-in shell code, you can always first establish a initial http
get request to check whether you're redirected or not(or can directly
access the target page).

2. if you're not login yet and redirected, you should programmtically login
first.

3. After make sure you're login, you can just send http post with the
correct querystring(nee d to add the cookie data also).

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead
Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
ms****@microsof t.com.

=============== =============== =============== =====
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications.
=============== =============== =============== =====
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------

>From: "Nick" <[e-mail]>
Subject: Re: Url Redirection
Date: Wed, 6 Aug 2008 14:27:07 +0100

>
Hi Steven,

Indeed, it's part of an unmanaged addin for another application and
invoking via the shell is the most efficient way of achieving the desired
result as the browser will need to be opened if it isn't already.

I don't seem to have any control over this as it's all handled
internally and controlled via the web.config file afaik. So here is my
current thoughts...

1. The URL is created and escaped correctly.
2. The URL works on the site if logged in already
3. If not logged in ASP.NET screws with the URL and makes it invalid
then kicks you back to the login page.

So using my advanced powers of deduction. asp.net is screwing with my
query string and making it unusable? Therefore I can't see how this can

be

>worked around unless I can modify the query string during this process but
unfortunatel y none of my code is hit in page load for me to be able to.

Or

>am I able to perform the bounce manually somehow?

Thanks for your time again!

Nick.

"St