title: ReturnUrl Points to an ActionResult
body: <p>Here is how the scenario goes:</p>
  
  <ul>
  <li>Start an MVC project from scratch</li>
  <li>Test Controller decorated with [Authorize] attribute</li>
  <li>User Logs in and directed to Home</li>
  <li>User clicks a link that redirects to the <code>TestController</code>'s <code>Index</code> method</li>
  <li>User waits 60 seconds for the Forms Authentication to timeout</li>
  <li>User clicks a link that calls an <em>ActionMethod</em> residing on the <code>TestController</code></li>
  <li>The MVC framework redirects user to Login page and attaches the <em>ActionMethod</em> name to the URL instead of attaching the <code>Index</code> Action Method</li>
  </ul>
  
  <p><strong>TestController</strong>:</p>
  
  <pre><code>[Authorize]
  public class TestController : Controller
  {
      // GET: Test
      public ViewResult Index()
      {
          return View();
      }
  
      [ValidateInput(false)]
      public ActionResult ActionTest()
      {
          return new EmptyResult();
      }
  }
  </code></pre>
  
  <p><strong>HomeController</strong>:</p>
  
  <pre><code>[Authorize]
  public class HomeController : Controller
  {
      public ActionResult Index()
      {
          return View();
      }
  }
  </code></pre>
  
  <p><strong>AccountController</strong>:</p>
  
  <pre><code>public class AccountController : Controller
  {
      [AllowAnonymous]
      public ActionResult Login()
      {
          return View();
      }
  
      [HttpPost]
      [AllowAnonymous]
      [ValidateAntiForgeryToken]
      public ActionResult Login(LoginViewModel model, string returnUrl)
      {
          if (ModelState.IsValid)
          {
              try
              {
                  FormsAuthentication.SetAuthCookie(model.UserName, model.RememberMe);
  
                  if (Url.IsLocalUrl(returnUrl))
                  {
                      return Redirect(returnUrl);
                  }
                  else
                      return RedirectToAction(controllerName: "Home", actionName: "Index");
              }
              catch
              {
                  return View(model);
              }
          }
          return View(model);
      }
  }
  </code></pre>
  
  <p><strong>Login.chtml</strong></p>
  
  <pre><code>@model TestLoginProject.Models.LoginViewModel
  
  @{
      Layout = null;
  }
  
  &lt;!DOCTYPE html&gt;
  &lt;html lang="en"&gt;
  &lt;head&gt;
    .....................
  &lt;/head&gt;
  
  &lt;body&gt;
      &lt;div class="container"&gt;
          @using (@Html.BeginForm("Login", "Account", new { returnUrl = Request.QueryString["ReturnUrl"] }, FormMethod.Post, new { @class = "form-signin" }))
          {
              @Html.AntiForgeryToken()
              ....................
              ....................
          }
      &lt;/div&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p><strong>Web Config</strong></p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
    &lt;forms loginUrl="~/Account/Login" timeout="1" /&gt;
  &lt;/authentication&gt;
  </code></pre>
  
  <p><strong>The expectation of the return url is</strong>:</p>
  
  <blockquote>
    <p><a href="http://localhost:2441/Account/Login?ReturnUrl=%2fTest%2fIndex" rel="nofollow noreferrer">http://localhost:2441/Account/Login?ReturnUrl=%2fTest%2fIndex</a></p>
  </blockquote>
  
  <p><strong>Instead, the current value is</strong>:</p>
  
  <blockquote>
    <p><a href="http://localhost:2441/Account/Login?ReturnUrl=%2fTest%2fActionTest" rel="nofollow noreferrer">http://localhost:2441/Account/Login?ReturnUrl=%2fTest%2fActionTest</a></p>
  </blockquote>
  
  <p><strong>Notes</strong>:</p>
  
  <ul>
  <li>When a user clicks the link after timeout, no Test Actions are hit before the redirection to the Login page takes place</li>
  <li>All routes are the default as provided when starting an Empty MVC project from scratch in VS2017</li>
  </ul>