diff --git a/trac/web/api.py b/trac/web/api.py
--- a/trac/web/api.py
+++ b/trac/web/api.py
@@ -181,6 +181,9 @@
                       doc='The HTTP method of the request')
     path_info = property(fget=lambda self: self.environ.get('PATH_INFO', '').decode('utf-8'),
                          doc='Path inside the application')
+    query_string = property(fget=lambda self: self.environ.get('QUERY_STRING',
+                                                               ''),
+                            doc='Query part of the request')
     remote_addr = property(fget=lambda self: self.environ.get('REMOTE_ADDR'),
                            doc='IP address of the remote user')
     remote_user = property(fget=lambda self: self.environ.get('REMOTE_USER'),
diff --git a/trac/web/auth.py b/trac/web/auth.py
--- a/trac/web/auth.py
+++ b/trac/web/auth.py
@@ -197,7 +197,7 @@
 
     def _redirect_back(self, req):
         """Redirect the user back to the URL she came from."""
-        referer = req.get_header('Referer')
+        referer = req.args.get('referer', req.get_header('Referer'))
         if referer and not (referer == req.base_url or \
                 referer.startswith(req.base_url.rstrip('/')+'/')):
             # only redirect to referer if it is from the same site
diff --git a/trac/web/href.py b/trac/web/href.py
--- a/trac/web/href.py
+++ b/trac/web/href.py
@@ -129,7 +129,7 @@
             if type(value) in (list, tuple):
                 for i in [i for i in value if i != None]:
                     params.append((name, i))
-            elif v != None:
+            elif value != None:
                 params.append((name, value))
 
         if args:
diff --git a/trac/web/main.py b/trac/web/main.py
--- a/trac/web/main.py
+++ b/trac/web/main.py
@@ -437,6 +437,11 @@
         data = {'title': title, 'type': 'TracError', 'message': e.detail,
                 'frames': [], 'traceback': None}
         try:
+            if e.code == 403 and req.authname == 'anonymous':
+                referer = env.abs_href(req.path_info)
+                if req.query_string:
+                    referer += '?' + req.query_string
+                req.redirect(env.href('login', {'referer': referer}))
             req.send_error(sys.exc_info(), status=e.code, env=env, data=data)
         except RequestDone:
             pass