c# - Why is my query string so long? -

i using mvc 5, , got following message:

"the request filtering module configured deny request query string long."

why query string long?
notice how repeats same information over-and-over. trying default [authorize] using global filtering, haven't altered in web.config...what cause this?

query string loks like:
localhost:80/yourapplication/account/login?returnurl=%2fyourapplication%2faccount%2flogin%3freturnurl%3d%252fyourapplication%252faccount%252flogin%253freturnurl%253d%25252fyourapplication%25252faccount%25252flogin%25253freturnurl%25253d%2525252fyourapplication%2525252faccount%2525252flogin%2525253freturnurl%2525253d%252525252fyourapplication%252525252faccount%252525252flogin%252525253freturnurl%252525253d%25252525252fyourapplication%25252525252faccount%25252525252flogin%25252525253freturnurl%25252525253d%2525252525252fyourapplication%2525252525252faccount%2525252525252flogin%2525252525253freturnurl%2525252525253d%252525252525252fyourapplication%252525252525252faccount%252525252525252flogin%252525252525253freturnurl%252525252525253d%25252525252525252fyourapplication%25252525252525252faccount%25252525252525252flogin%25252525252525253freturnurl%25252525252525253d%2525252525252525252fyourapplication%2525252525252525252faccount%2525252525252525252flogin%2525252525252525253freturnurl%2525252525252525253d%252525252525252525252fyourapplication%252525252525252525252faccount%252525252525252525252flogin%252525252525252525253freturnurl%252525252525252525253d%25252525252525252525252fyourapplication%25252525252525252525252faccount%25252525252525252525252flogin%25252525252525252525253freturnurl%25252525252525252525253d%2525252525252525252525252fyourapplication%2525252525252525252525252faccount%2525252525252525252525252flogin%2525252525252525252525253freturnurl%2525252525252525252525253d%252525252525252525252525252fyourapplication%252525252525252525252525252faccount%252525252525252525252525252flogin%252525252525252525252525253freturnurl%252525252525252525252525253d%25252525252525252525252525252fyourapplication%25252525252525252525252525252faccount%25252525252525252525252525252flogin%25252525252525252525252525253freturnurl%25252525252525252525252525253d%2525252525252525252525252525252fyourapplication%2525252525252525252525252525252faccount%2525252525252525252525252525252flogin%2525252525252525252525252525253freturnurl%2525252525252525252525252525253d%252525252525252525252525252525252fyourapplication%252525252525252525252525252525252faccount%252525252525252525252525252525252flogin

the code looks like:
testing see if can default [authorize] everywhere & still have custom error pages come up. however, error mentioned above arises instead of redirecting. have no "httperrors" or "customerrors" entries in web.config.

protected void application_start() {     arearegistration.registerallareas();     globalconfiguration.configure(webapiconfig.register);     filterconfig.registerglobalfilters(globalfilters.filters);     routeconfig.registerroutes(routetable.routes);     bundleconfig.registerbundles(bundletable.bundles); }  protected void application_error(object sender, eventargs e) {     var exception = server.getlasterror();     var httpexception = exception httpexception;     response.clear();     server.clearerror();     var routedata = new routedata();     routedata.values["controller"] = "error";     routedata.values["action"] = "general";     routedata.values["exception"] = exception;     response.statuscode = 500;     if (httpexception != null)     {         response.statuscode = httpexception.gethttpcode();         switch (response.statuscode)         {             case 403:                 routedata.values["action"] = "forbidden";                 break;              case 404:                 routedata.values["action"] = "notfound";                 break;             case 500:                 routedata.values["action"] = "unexpected";                 break;         }     }      icontroller errorscontroller = new errorcontroller();     var rc = new requestcontext(new httpcontextwrapper(context), routedata);     errorscontroller.execute(rc); }  public class filterconfig {     #region <methods>      public static void registerglobalfilters(globalfiltercollection filters)     {         // force: authorize on actions (by default)         filters.add(new authorizeattribute());     }      #endregion }  // authorize attribute defaulted on actions...so don't need here public class accountcontroller : basecontroller {     #region <actions>      [httpget]     // test see errors page come put nothing here     public actionresult login(string returnurl)     {         // user-call should redirected error page when called...but oddly isn't     }      #endregion }  [allowanonymous] public class errorscontroller : controller {     #region <actions>      // get: /errors/unexpected     [httpget]     [allowanonymous]     public actionresult unexpected()     {         tracehandler.tracein(tracelevel.error);          var unitofwork = new applicationunitofwork();         var viewmodel = new unexpectederrorviewmodel(unitofwork);          response.statuscode = (int)viewmodel.statuscode;         response.tryskipiiscustomerrors = true;          tracehandler.traceout();         return view(viewmodel);     }      // get: /errors/forbidden     [httpget]     [allowanonymous]     public actionresult forbidden()     {         tracehandler.tracein(tracelevel.error);          var unitofwork = new applicationunitofwork();         var viewmodel = new forbiddenerrorviewmodel(unitofwork);          response.statuscode = (int)viewmodel.statuscode;         response.tryskipiiscustomerrors = true;         response.suppressformsauthenticationredirect = true;          tracehandler.traceout();         return view(viewmodel);     }      // get: /errors/notfound     [httpget]     [allowanonymous]     public actionresult notfound()     {         tracehandler.tracein(tracelevel.error);          var unitofwork = new applicationunitofwork();         var viewmodel = new notfounderrorviewmodel(unitofwork);          response.statuscode = (int)viewmodel.statuscode;         response.tryskipiiscustomerrors = true;          tracehandler.traceout();         return view(viewmodel);     }      #endregion } 

for reason, login page redirecting login page, in turn redirected login page and...

are using standard asp.net mvc login system? configuration did change? did remove [allowanonymous] attribute on login method?

there [authorize] attribute on accountcontroller allows logged-in users see actions. not wanted login , register , other methods should accessed anonymous users.