url rewriting and returnUrl

Hi All, as is this my first post I would like say hello to everyone. I ‘m
currently struggling with the problem and I’ve couldn’t find solution
anywhere.I’m using ISAPI_Rewrite for url rewriting and I have a problem with
returnUrl which is return when user is not authorized to see the page (real url
is returned not rewritten). Is there a way to set returnUrl on my own? Where
does the event of redirecting to the login page take place? I thought that maybe
I could write my own authorization mechanism and when user is not authorized to
see the page I would set returnUrl and redirect him to login page. But where and
how to check if user is authorized when his not logged?
Application_AuthorizeRequest and Application_AuthenticateRequest are both called
even when main page is loaded and there are no authorization setting is
web.config. Maybe someone find solution to this problem? Thank you in advance
for any help.Best Regards.

So if he is no longer authorised to be returned to the login.aspx?

 Use this in the MasterPage:

protected void Page_Load(object sender, EventArgs e)
    {
        if (!Page.User.Identity.IsAuthenticated)
            Response.Redirect("Login.aspx", false);
    }

Thanks for reply.

Is there any security risk if I use that kind of authorization in Page_Load
instead of using standard authorization mechanism (web.config)?

Well have you tried that first? The only problem I see is that you are
hardcoding some stuff, other then that.... You could put your login page name in
as an appsetting in the web.config, this way you won't have the filename
hardcoded.

Now the question is why you not using the option in the web.config. Do you use
urlRewriting? Does that mess up you link? If so, you could add a new rule in
your web.config to exclude that link from the rewriting.

If you found this useful, please mark it as an answer. Thank you.

I’m using ISAPI_Rewrite for url rewriting and it messes up the returnUrl.
For example if I enter mySite/mailbox/ I get redirected to
mySite/?returnUrl=MailBox.aspx. 

Could you explain what you meant by saying:
If so, you could add a new rule in your web.config to exclude that link from the
rewriting.