MVC returnUrl dangerous request.path

Question

This is a MVC 4 project, i'm trying to redirect the user to returnUrl after login and i'm having issues with the returnUrl encoding.

This is my login controller method:

        [ValidateInput(false)]
        [HttpPost]
        public ActionResult Login(Models.ViewModels.UserLogin user, string returnUrl)
        {
            if (ModelState.IsValid)
            {
                if (user.IsValid(user.UserName, HelpMethods.sha256(user.Password)))
                {
                    FormsAuthentication.SetAuthCookie(user.UserName, user.RememberMe);
                    if (returnUrl != null)
                    {
                        return RedirectToAction(Url.Encode(returnUrl));
                    }
                    return RedirectToAction("Index", "Home");
                }
                else
                {
                    ModelState.AddModelError("", "Fel användarnamn eller lösenord.");
                }
            }
            return View(user);
        }

With this code i get A potentially dangerous Request.Path value was detected from the client (&). I did some research and tried the following things without success.

1. [ValidateInput(false)]
2. <requestFiltering allowDoubleEscaping="true"/>
3. <httpRuntime requestValidationMode="2.0" />, There is a duplicate 'system.web.extensions/scripting/scriptResourceHandler' section defined", this error is because you are running a .NET Framework 3.5-based application in .NET Framework 4. If you are running WebMatrix, to resolve this problem, go to the Settings node to set the .NET Framework version to ".NET 2". You can also remove the extra sections from the web.config file.

I need some advice on how to solve this, thank you.

Answer 1

I think it is related to point 3:

<httpRuntime requestValidationMode="2.0" />

When you have changed that in your Web.Config, the error is resolved but immediately another error message pops-up.

You should perform the steps described in the error message, or you should remove the 'system.web.extensions/scripting/scriptResourceHandler' section in either your web.config (if possible) or in the machine.config(s).

32-bit

%windir%\Microsoft.NET\Framework\[version]\config\machine.config

64-bit

%windir%\Microsoft.NET\Framework64\[version]\config\machine.config

The reason why this is happening is because you have installed some piece of software that modifies your machine.config file.