title: ASP.NET MVC application behind reverse proxy - using wrong host name after auth
body: <p>I have an ASP.NET MVC application using OWIN authentication that is running behind a reverse proxy.</p>
  
  <p>The authentication in ASP.NET is set up like this:</p>
  
  <pre><code>        app.UseCookieAuthentication(new CookieAuthenticationOptions
          {
              AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
  
              LoginPath = new PathString("/Account/Login"),
              Provider = new CookieAuthenticationProvider
              {
                  // Enables the application to validate the security stamp when the user logs in.
                  // This is a security feature which is used when you change a password or add an external login to your account.  
                  OnValidateIdentity = SecurityStampValidator.OnValidateIdentity&lt;ApplicationUserManager, ApplicationUser&gt;(
                      validateInterval: TimeSpan.FromMinutes(30),
                      regenerateIdentity: (manager, user) =&gt; user.GenerateUserIdentityAsync(manager))
              }
          });
  </code></pre>
  
  <p>The reverse proxy in iis is setup like this in the web.config:</p>
  
  <pre><code>&lt;system.webServer&gt;
  &lt;httpErrors errorMode="Detailed" /&gt;
  &lt;asp scriptErrorSentToBrowser="true"/&gt;
      &lt;rewrite&gt;
              &lt;rule name="proxy" stopProcessing="true"&gt;
                  &lt;match url="^app/?(.*)" /&gt;
                  &lt;serverVariables&gt;
                      &lt;set name="X_REQUESTED_URL_PATH" value="{R:1}" /&gt;
                  &lt;/serverVariables&gt;
                  &lt;action type="Rewrite" url="https://myapp.mydomain.toplevel/app/{R:1}" /&gt;
              &lt;/rule&gt;
      &lt;/rewrite&gt;
  &lt;system.webServer&gt;
  </code></pre>
  
  <p>The reverse proxy is hosted at <a href="https://www.mydomain.toplevel/app/" rel="nofollow noreferrer">https://www.mydomain.toplevel/app/</a>{R:1}</p>
  
  <p>Everything is working fine, RedirectToAction will redirect to www.mydomain.toplevel.</p>
  
  <p>But when I try to open a controller with the AuthenticationAttribute, the redirect will go to <a href="https://myapp.mydomain.toplevel/account/login" rel="nofollow noreferrer">https://myapp.mydomain.toplevel/account/login</a> instead of www.mydomain.toplevel</p>
  
  <p>How can I configure this that my application stays behind the reverse proxy, even when the auth redirect is happening? As a first workaround, I tried to hardcode the LoginPath with the hostname in front, but this will give an error that the path should start with a /.</p>