What is ReturnURL in mvc3

Question 1

When an unauthenticated user tries to get into a section of your application which requires authentication, then returnUrl comes into the picture.The Url requested by the unauthenticated user is basically stored in returnurl.

for example below controller decorated with Authorize attribute :

[Authorize]
public ActionResult Login(string returnUrl)
{
    ViewBag.ReturnUrl = returnUrl;
    return View();
}

The login action grabs the value of this parameter and puts it in the ViewBag so it can be passed to the View. The View then stores this value in the form as shown by this line of code in the View.

@using (Html.BeginForm(new { ReturnUrl = ViewBag.ReturnUrl }))

The reason it is stored in the View is so that when the user does a Submit after entering their user name and password, the controller action that handles the post back will have access to this value.

Question 2

Your application must be having Authentication for login which is handled by [Authorize] attribue. as user is not authenticated it returns to logon page with returnurl as admin

For more on AuthorizeAttribute How to use authorize attribute on MVC3

Below is the standard action of login when you login above returnurl ie admin is passes as second parameter, depending on which user is redirected to the page using return Redirect(returnUrl);

 [HttpPost]
        public ActionResult LogOn(LogOnModel model, string returnUrl)
        {
            if (ModelState.IsValid)
            {
                if (Membership.ValidateUser(model.UserName, model.Password))
                {
                    FormsAuthentication.SetAuthCookie(model.UserName, model.RememberMe);
                    if (Url.IsLocalUrl(returnUrl) && returnUrl.Length > 1 && returnUrl.StartsWith("/")
                        && !returnUrl.StartsWith("//") && !returnUrl.StartsWith("/\\"))
                    {
                        return Redirect(returnUrl);
                    }
                    else
                    {
                        return RedirectToAction("Index", "Home");
                    }
                }
                else
                {
                    ModelState.AddModelError("", "The user name or password provided is incorrect.");
                }
            }

            // If we got this far, something failed, redisplay form
            return View(model);
        }

Question 3

Routing is one of the core concept of any ASP.NET MVC application. A URL of a MVC application is the combination of your Application root URL followed by Controller name and then Action to which request has been made e.g.

http://localhost:55875/{controller}/{action}/{optional parameters}

You probably have chosen new project with Account Controller and Authorization membership providers. As fellow members has mentioned, the Authorize attribute is probably the main reason you are being redirected to logon page.

From the documentation of Authorize attribute:

If an unauthorized user tries to access a method that is marked with the Authorize attribute, the MVC framework returns a 401 HTTP status code. If the site is configured to use ASP.NET forms authentication, the 401 status code causes the browser to redirect the user to the login page.

In browsers, whenever you hit enter key in address bar, browser always make a GET request to the server for resources.

That is what could have happened. Either your Admin Controller or its Index() method is decorated with [Authorize] action filter attribute e.g.

public class AdminController : Controller
{
    ///<summary>
    /// This view will open whenever you make a HTTP GET request to your Admin
    /// controller without providing any action method name in request explicitly. 
    /// Because it is decorated with Authorize attribute, any user who has not logged in 
    /// will be redirected to the login page...
    ///</summary>
    [Authorize]    
    public ActionResult Index()
    {
        return View();
    }
}

You may wonder why did application redirected to login view?

This is because by default this action has been set in your application inside your web.config file.

<authentication mode="Forms">
  <forms loginUrl="~/Account/Logon"/>
</authentication>

MVC leverages the power of built-in authentication logic and redirects the user to view that has been set under loginUrl.

Try removing the [Authorize] action filter just for a change and see what happens. In the end it is your business logic to decide on which views you need to have only authorize or anonymous access.

However, you may also take a look at AllowAnonymous attribute. It allows you to skip authorization for a perticular contoller or action.

[Authorize]
public class AdminController : Controller
{
    ///<summary>
    /// Skips Authorization..
    ///</summary>
    [AllowAnonymous]    
    public ActionResult Index()
    {
        return View();
    }

    ///<summary>
    /// Only allows authorize access...
    ///</summary>        
    public ActionResult Secure()
    {
        return View();
    }
}

You can customize/override the behavior of these action filters as well.

Notice, [Authorize] has been added to controller itself if you have selected the project with internet and membership providers which will make all the actions inside this authorized except those with [AllowAnonymous] filter (if exists).

This article has good overview of Action filters in MVC.

Question 4

First: you are trying to access an authorized page so every time you are trying to access this page the application automatically redirect you to login page

Second: how this happened? in web.config file you can find a section for authentication

<authentication mode="Forms"  >
  <forms loginUrl="~/Account/Logon"/>
</authentication>

this section says that each time you are trying to access authorized page you will be redirected to this page and since its forms authentication so you will be redirected to this page

another thing you may using Authorize an AuthorizeAttribute which tells the application that the following ActionResult can't be accessed by anonymous users you can use this attribute in class level or ActionResult level as follows

[Authorize]
public class HomeController 
{
}

Or

public class HomeController 
{
    [Authorize]
    public ActionResult Index()
    {
    }
}