private string NormalizeReturnUrl(string returnUrl, Func <string> defaultValueBuilder = null) { if (defaultValueBuilder == null) { defaultValueBuilder = GetAppHomeUrl; } if (returnUrl.IsNullOrEmpty()) { return(defaultValueBuilder()); } if (Url.IsLocalUrl(returnUrl) || _webUrlService.GetRedirectAllowedExternalWebSites().Any(returnUrl.Contains)) { return(returnUrl); } return(defaultValueBuilder()); }