When to use LocalRedirect vs RedirectToPage

LocalRedirect should be used when you’re dealing with a “return URL”, i.e. you’re passing around a URL that the user should be redirected back to after some process is complete, such as logging in. In such cases, a malicious actor could send a user to your login form, for example, with a return URL back to a malicious site. Using LocalRedirect ensures that the “return URL” is a route actually on your site, instead of some malicious third-party bad actor’s.

All the other redirect result types can be used when you are directly controlling where the user is being redirected to.

Leave a Comment