Skip to content

Where this file lives

  • This path (docs/portal/locked-content-redirect-behavior.md) is inside the rakletv3 repo for review and maintenance.
  • This document describes the current locked portal redirect behavior when anonymous homepage access is enabled.

Locked Content Redirect Behavior

Generated: 2026-04-21 Repo: rakletadmin/rakletv3 Focus: Locked portal access for anonymous users with or without anonymous homepage configuration

Purpose

Describe how LockPortalContentAttribute decides whether an anonymous request may continue, must redirect to the homepage, or must redirect to login.

Scope

  • Application/Infrastructure/LockPortalContentAttribute.cs
  • Locked content behavior for anonymous visitors
  • Anonymous homepage handling
  • Login redirect behavior for protected routes

Current rules

  1. ApplyController and SignupController bypass the lock filter.
  2. If locked content is disabled, the request continues.
  3. If the visitor is authenticated, the request continues.
  4. If locked content is enabled and an anonymous homepage is configured:
  5. The request may continue only when the current request URL matches the portal homepage URL after removing query string and fragment parts.
  6. Example: https://example.com and https://example.com/?reason=LockedContent are treated as the same homepage request.
  7. Any anonymous request outside the homepage is redirected to the login host, not the portal host:
  8. Shape: PathService.GetV3LoginPath(permalink) + "/Error/NotAuthorized?permalink={permalink}&returnUrl={returnUrl}&reason=LockedContent"
  9. Example: https://login.<domain>/<permalink>/Error/NotAuthorized?permalink=<permalink>&returnUrl=<returnUrl>&reason=LockedContent

Why query normalization matters

The homepage redirect can append reason=LockedContent to explain why the visitor was redirected. If the comparison uses the full absolute URL, the homepage request no longer matches itself and the filter keeps redirecting the same request forever.

The filter now compares only the path-level homepage URL. This prevents redirect loops while still allowing the homepage itself to stay public.

User-facing outcome

  • Anonymous visitors can open the configured anonymous homepage without a loop.
  • Anonymous visitors who click any protected menu item are redirected to login instead of being bounced back into a homepage loop.
  • Logout flows that land on a locked route no longer produce ERR_TOO_MANY_REDIRECTS.

QA checklist

  • Enable Locked Content.
  • Configure an anonymous homepage.
  • Open the homepage while logged out and confirm it renders normally.
  • Open /?reason=LockedContent and confirm it still renders normally.
  • While logged out, click a protected menu item and confirm the flow goes to login.
  • Logout from an authenticated session and confirm the user does not hit a redirect loop.