title: How to make Asp.NET Core MVC app use external urls on Authorize redirection?
body: <p>I'm looking for a solution for the problem stated in question title.
  To be more precise - I'm running test app (asp.net core/mvc) and tunneling it to be accessible world-wide using <a href="https://ngrok.com" rel="nofollow noreferrer">https://ngrok.com</a>. The command I'm using for this is:  </p>
  
  <blockquote>
    <p>ngrok.exe http -host-header=rewrite localhost:62274</p>
  </blockquote>
  
  <p>"ngrok.exe http" is used to initialize ngrok, "-host-header=rewrite localhost:62274" changes header to allow app to be executed (since IIS checks header and block any other).  </p>
  
  <p>The problem I ran into is that after failed authorization (guests trying to access restricted page) <strong>[Authorize] points to internal links</strong> (ex. "<a href="http://localhost:62274/Account/Login" rel="nofollow noreferrer">http://localhost:62274/Account/Login</a>"). This is <strong>not</strong> intended.<br>
  All of the links provided by app's Views are working properly (they use address prefix provided by ngrok). I had to fix returnUrl parameters for Login/Register but they are working flawlessly now.  </p>
  
  <p>I searched for answer for that problem for 2 days now. As stated before it's a test app I'm making to learn programming in .net core. The restriction is that <strong>I don't want to write my own Authorization</strong> - it's prone to my inexperience, it would require constant security updates and there's no point in reinventing the wheel, right?  </p>
  
  <p>Problem occurs on:  </p>
  
  <pre><code>[Authorize("Admin")]
  public async Task&lt;IActionResult&gt; DeleteDItem(int? id)
  </code></pre>
  
  <p>Instead of redirecting to: http://&lt;8_random_characters>.ngrok.io/Account/Login it points to: <a href="http://localhost:62274/Account/Login" rel="nofollow noreferrer">http://localhost:62274/Account/Login</a></p>
  
  <p>More details (this is a first question I write here EVER so I want it to be somewhat proper):<br>
  - it's a ASP.NET Core Web Application using MVS2015's default "Individual User Authentication",<br>
  - related project.json info:  </p>
  
  <pre><code>"dependencies": {  
    "BundlerMinifier.Core": "2.1.258",  
    "Microsoft.ApplicationInsights.AspNetCore": "1.0.0",  
    "Microsoft.AspNet.Authentication.Google": "1.0.0-rc1-final",  
    "Microsoft.AspNetCore.Authentication.Cookies": "1.0.0",  
    "Microsoft.AspNetCore.Authentication.Facebook": "1.0.0",  
    "Microsoft.AspNetCore.Authentication.Google": "1.0.0",  
    "Microsoft.AspNetCore.Authorization": "1.0.0",  
    "Microsoft.AspNetCore.Diagnostics": "1.0.0",  
    "Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore": "1.0.0",  
    "Microsoft.AspNetCore.Identity.EntityFrameworkCore": "1.0.0",  
    ...
    "Npgsql.EntityFrameworkCore.PostgreSQL": "1.0.0"
  </code></pre>
  
  <p>- related parts of Startup.cs:</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
    services.AddAuthorization(options =&gt;
    {
      options.AddPolicy("Admin", policy =&gt; 
                                 policy.RequireAuthenticatedUser());                
    });
    services.AddIdentity&lt;ApplicationUser, IdentityRole&gt;()
            .AddEntityFrameworkStores&lt;ApplicationDbContext&gt;()
            .AddDefaultTokenProviders();
  }
  
  public void Configure(IApplicationBuilder app, IHostingEnvironment env,
                        ILoggerFactory loggerFactory)
  {
    app.UseIdentity();
  }
  </code></pre>