Unable to get proper referrer after AAD authentication in Application_PostAuthenticateRequest - asp.net-mvc-5

Question

I have a scenario for redirection for certain users belonging to a DL. This is an AAD authenticated app.
If the user belongs to a certain DL, the application should load. Other wise the user should be redirected to another app("https://validreferrer"). And he has to click the link on the other app("https://validreferrer") to come to my app.
I am putting this check in post_authenticate event. I check the referrer . If this is a valid referrer("https://validreferrer") then proceed. If not check if the user belongs to the DL. If user doesnt belong to the DL then redirect the user to "https://validreferrer", else set the validated cookie and proceed with accessing the site.
If the user doesnot belong to the DL - The first time referrer comes as https://login.microsoftonline.com/72f98... as the request is authenticated from AD, so referrer becomes this and the referrer check fails. Then the user belonging to the DL check is performed and the user is redirected.
But, If the user first hits the other app - "https://validreferrer", and then clicks the link to come to my app, the referrer still comes as https://login.microsoftonline.com/72f98... instead of "https://validreferrer" and the user again is validated for belonging to the DL and then redirected. Now again if the user clicks on the external site("https://validreferrer") to come to my site, the referrer comes correctly.
How can I avoid this double redirection.
I tried to capture the referrer in session start, the first time the user comes via proper site("https://validreferrer"), but the referrer ("https://validreferrer") is populating only for Chrome. Not in the case of IE or Edge.
Is there any Request property which I can use to distinguish between the two calls? Or is there any other way to solve this problem?
Sample Code -
// This is capturing referrer only via chrome. Not working in IE and Edge
protected void Session_Start(object sender, EventArgs e)
{
if (Request.UrlReferrer != null &&
HttpContext.Current.Request.Cookies["UrlReferrer"] == null)
{
HttpContext.Current.Response.Cookies.Add(new HttpCookie("UrlReferrer", Request.UrlReferrer.ToString()));
}
}
protected void Application_PostAuthenticateRequest(object sender, EventArgs e)
{
if (this.Request.IsAuthenticated && HttpContext.Current.Request.Cookies["Validated"] == null )
{
bool userinDL= true;
//check if the referrer is correctly set do nothing
//else check if this is a ring zero user. If not, redirect
if ((Request.UrlReferrer == null || !Request.UrlReferrer.ToString().Contains("https://validreferrer")))
{
userinDL= CheckuserMembership();
if (!userinDL)
{
Response.Redirect("https://validreferrer");
}
else
{
HttpContext.Current.Response.Cookies.Add(new HttpCookie("Validated", "true"));
}
}
}
else
{
HttpContext.Current.Response.Cookies.Add(new HttpCookie("Validated", "true"));
}
}
}

Answer 1

AFAIK ,Request.UrlReferrer is unreliable approach as many proxy/firewall servers strip this
field from the request for security concerns .
If your requirement is just check whether the request is from another app , and you have access to "https://validreferrer" app and can modify the source , then a possible solution would be : you could try to append a querystring variable to the url link of another app , then in current app capture the querystring variable to distinguish the referrer. Related thread is for your reference .