title: Is it secure to put a callback URL in a URL's query string?
body: <p>I'm working on an ASP.NET MVC5 web app.  Say a user's session times out and they must go to a login screen to authenticate again, then be redirected back to the URL they came from.  Is it good practice to put the return (callback) URL in the query string of the login URL?</p>
  
  <p>Does anybody know about the PCI compliance for this?  I remember going through PCI training and they mentioned callback URLs, but I can't remember if this follows compliance or not.  If not, is there a more secured way in ASP.NET MVC to pass a callback URL?  I'm currently not using any Auth/Auth libraries, just doing all authentication by hand using cookie management...</p>
  
  <p>Thanks in advance!</p>