Status code 500 when returnUrl is invalid

[hugoqribeiro]

Using Duende.BFF 3.0.0...

When passing in an invalid URL (not local) to the login endpoint, I'm getting an exception, thus a result with status code 500.

Exception: returnUrl is not valid: https://localhost:3000/
Duende.Bff.DefaultLoginService.ProcessRequestAsync(HttpContext context) in DefaultLoginService.cs

Is this correct? Shouldn't it be a 401?

[RolandGuijt]

Agreed that simply returning 500 is not the ideal behavior. Thanks for this suggestion!
I think the status code 400 would be the most suitable here. I've created an issue for our product team to pick up so you can expect the behavior to change in a next version.

[Erwinvandervalk]

Thank you for reporting this. This is now fixed and will be released in the upcoming 4.0 RC and 3.1 releases.