asp.net returnURL page validation to avoid man in middle attack
<p>I've asp.net webform application. I notice that the .net framework automatically includes the name of return url if not logged in.</p>

<p>I would like to validate the returnURL page so that there's no external url (created by man-in-middle attack). Could anyone please suggest whether this can be achived easily out of box in asp.net 3.5?</p>

<p>Thanks</p>
