if (!string.IsNullOrWhiteSpace(returnUrl) && !Url.IsLocalUrl(returnUrl))
{
    throw new Exception($"An open redirection attack was detected.  User was going to login and then be returned to: {returnUrl}.");
}