Flex Application with browser and .net MVC RedirectToAction == BadRequest

I have a flex application with an HTML browser in it.

Whenever I try to log into my .net 4 MVC 3 application I get redirected to a url like this:

http://dev.example.com/(F(pvQgwsX3QvLrI1tN0JENknfz27yN7H00FCaLw_N06qL_SvBGmbS9Mc8V9BIlergVUhGiLeg-JU5HnEE-fzXtWqtVq-S5Pk393AXbifUTmcH29sDF9e028kpbYbX8L-VOY75QXYzXHTDfb06ozuOJzPvPB-y8atHn2B3BoDyiZMBd3DCjdO4meTwp9kvNY6ZarXbFByTU932Hu95lRcTq6yJzQ8y5Ree28nqgjqVHKEV77noegweTKkZ0_5IUZYnE0))/someDirectory

and this only happens when in the Flex browser (Adobe Air 2.6). Logging on with a regular internet browser is fine.

The login code is as follows:

    [HttpPost]
    [ActionName("sign-in")]
    public ActionResult Signin(SignInModel model, string returnUrl)
    {
        if (ModelState.IsValid)
        {
            if (MembershipService.ValidateUser(model.Email, model.Password))
            {
                FormsService.SignIn(model.Email, model.RememberMe);
                if (Url.IsLocalUrl(returnUrl) && false)
                {
                    return Redirect(returnUrl);
                }
                else
                {
                    return RedirectToAction("Index", "admin");
                }
 开发者_运维问答           }
            else
            {
                ModelState.AddModelError("", "The user name or password provided is incorrect.");
            }
        }

        // If we got this far, something failed, redisplay form
        return View("signin", model);
    }

Any idea what that url is and how to get it to work?

Just on a whim I decided to change the user-agent of the the flex browser to the one used by Chrome and viola! - it works.

Apparently .net or MVC 3 doesn't like flex's userAgent string and decides to muck up the url. It is probably trying to set cookieless sessions or something (which my application isn't set up for).

So here is my new, working user-agent string:

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/531.9 (KHTML, like Gecko) Chrome/11.0.696.16 Safari/534.24

This url is used by ASP.NET when the browser doesn't support cookies or they have been turned off. It is nothing specific to ASP.NET MVC. Because there are no cookies the authentication token is sent in the url in order to keep track of logged in users.