dotnet / dotnet/aspnetcore

Redirect should encode URLs if it needs to

Open
#4,919 27 comments 4 reactions 0 assignees View on GitHub
affected-medium area-mvc breaking-change enhancement feature-routing severity-minor
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

All these issues are result of people trying to redirect to a URL that is not all ASCII. Resolution seems to be "you should have encoded your URL".

https://github.com/aspnet/Home/issues/2678
https://github.com/aspnet/Mvc/issues/7701
https://github.com/aspnet/KestrelHttpServer/issues/2508
https://github.com/aspnet/KestrelHttpServer/issues/2296
https://github.com/aspnet/Security/issues/1646
https://github.com/aspnet/HttpAbstractions/issues/971
https://github.com/aspnet/Routing/issues/513
https://github.com/aspnet/Mvc/issues/7529
https://github.com/aspnet/HttpAbstractions/issues/907
https://github.com/aspnet/Mvc/issues/6609
https://github.com/aspnet/Home/issues/2106
https://github.com/madskristensen/Miniblog.Core/issues/87
https://github.com/dotnet/aspnetcore/issues/37337 (unicode host)

However, the fact that the RedirectResult puts the URL into a HTTP header (which is the ultimate source of the issue) is an implementation detail that the caller cannot magically assume. It is therefore responsibility of e.g. RedirectResultExecutor to meet the requirements and ensure the URL is properly formatted in case it decides to use HTTP headers for redirection.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.