title: When using AuthorizeAttribute, returnUrl is null when redirecting to specified url from the body of email
body: <p>I need to redirect to the correct <code>url</code> after the user is logged in.</p>
  
  <p>User will click on the Url in his email and if he is not authenticated he is redirected to the login page. There the user enters his credentials and when authorized, gets redirected to the <code>returnURL</code>.</p>
  
  <p>When debugging the code and calling <code>Login controller</code>, <code>returnUr</code>l parameter is <code>null</code>, even though I set it before sending email:</p>
  
  <pre><code>var queryString = @Url.Action("Index", "Details", new System.Web.Routing.RouteValueDictionary(new { id = model.Ticket.TicketId }), "http", Request.Url.Host);
  var ticketUrl = "&lt;a href='"
                  + @Url.Action("Index", "Details", new System.Web.Routing.RouteValueDictionary(new { id = model.Ticket.TicketId, returnUrl = queryString }), "http", Request.Url.Host)
                  + "'&gt;Go to your ticket&lt;/a&gt;";
  
  var email = EmailHelper.SendEmail(model.Ticket.TicketId, ticketUrl); 
  </code></pre>
  
  <p>The email link contains the <code>url</code> I need to redirect to.</p>
  
  <p>In the <code>login form</code>, I'm reading my <code>url</code> from the <code>querystring</code>:</p>
  
  <pre><code>@using (Html.BeginForm(null, null, FormMethod.Post, new { id = "LoginForm", returnUrl = Request.QueryString["returnUrl"] }))
  </code></pre>
  
  <p>I noticed, that the Application is using <code>CustomAuthorizeAttribute</code> class which  extends from <code>AuthorizeAttribute</code> class.</p>
  
  <p>In this class I tried to retrieve my <code>returnUrl</code>:</p>
  
  <pre><code>string returnUrl = filterContext.RequestContext.HttpContext.Request.QueryString["returnUrl"];
  </code></pre>
  
  <p>And was able to do so.</p>
  
  <p>This is the complete code for <code>CustomAuthorizeAttribute</code>:</p>
  
  <pre><code>public class CustomAuthorizeAttribute : AuthorizeAttribute
  {
      public override void OnAuthorization(AuthorizationContext filterContext)
      {
           base.OnAuthorization(filterContext);
           string returnUrl = filterContext.RequestContext.HttpContext.Request.QueryString["returnUrl"];
           HttpContext ctx = HttpContext.Current;
           Controller controller = filterContext.Controller as Controller;
           if (ApplicationSession.GetUser() == null)
           {
               UrlHelper urlHelper = new UrlHelper(filterContext.RequestContext);
               string loginURL = urlHelper.Action("Index", "Login");
               if (filterContext.HttpContext.Request.IsAjaxRequest())
               {
                   filterContext.HttpContext.Response.StatusCode = 403;
                   filterContext.Result = new JsonResult
                   {
                       Data = new
                       {
                           Error = "SessionExpired",
                           LoginURL = loginURL
                       },
                       JsonRequestBehavior = JsonRequestBehavior.AllowGet
                   };
               }
               else if(!string.IsNullOrEmpty(returnUrl))
               {
                   filterContext.Result = new RedirectResult(returnUrl);
               }
               else
               {
                   filterContext.Result = new RedirectResult(loginURL);
               }
           }
       }
   }
  </code></pre>
  
  <p>I noticed that this class is called twice.</p>
  
  <p>First time it is called when I click on the link from my email, it has <code>returnUrl</code> value, but it does not redirect to the correct <code>controller</code>, even though it hits the line of code with <code>Redirect</code> logic </p>
  
  <pre><code>else if(!string.IsNullOrEmpty(returnUrl))
  {
      filterContext.Result = new RedirectResult(returnUrl);
  }
  </code></pre>
  
  <p>Instead it hits another class that extends <code>ActionNameSelectorAttribute</code> class, then gets back to <code>CustomAuthorizeAttribute</code> class where </p>
  
  <p><code>filterContext.RequestContext.HttpContext.Request.QueryString["returnUrl"]</code> </p>
  
  <p>becomes <code>null</code> and then I get redirected to the default page as it usually does after login is successful.</p>
  
  <p>Can anyone point out what is wrong here? </p>