AuthorizeAttribute saves the redirect to / Account / Login

Question

I am trying to wrap my head around forms authentication in ASP.NET MVC. MVC 5 in my particular case, if that matters.

My application does not use passwords, just an email address as a username.

When debugging the Login method, I can clearly see that the model is valid, and my (user) MembershipProvider validates the user as expected.
It then redirects to the provided returnUrl (for testing purposes, I have AuthorizeAttribute on / Home / About).

Unfortunately, I immediately return to the Login view, so it’s obvious that I don’t have the fundamental element for the whole process (and, in general, the fundamental understanding of the whole auth / auth process, I have to admit that I rarely communicate with it).

Login Method:

 [HttpPost] [AllowAnonymous] [ValidateAntiForgeryToken] public async Task<ActionResult> Login(LoginViewModel model, string returnUrl) { if(ModelState.IsValid && Membership.ValidateUser(model.Email, "")) { FormsAuthentication.SetAuthCookie(model.Email, model.RememberMe); if (Url.IsLocalUrl(returnUrl)) { return RedirectToLocal(returnUrl); } else { return RedirectToAction("Index", "Home"); } } else { ModelState.AddModelError("", "Email address unknown"); } return View(model); } 

LoginViewModel:

 public class LoginViewModel { [Required] [Display(Name = "Email")] [EmailAddress] public string Email { get; set; } [Display(Name = "Remember me?")] public bool RememberMe { get; set; } } 

Relevant part of Web.config:

 <system.web> <authentication mode="Forms"> <forms loginUrl="~/Account/Login" timeout="2880" /> </authentication> </system.web> 

What I do not see? Where should I look?

Answer 1

You set your cookie using FormsAuthentication. If you use MVC5, they removed this type of authentication using the [Authorize] attribute.

Look for this in your web.config. Delete this line if you want to use FormsAuthentication.

  <system.webServer> <modules> <remove name="FormsAuthentication" /> </modules> </system.webServer> 

You can read this about why Microsoft removed FormsAuthentication in MVC5 and how to use OWIN instead: http://blogs.msdn.com/b/webdev/archive/2013/07/03/understanding-owin-forms-authentication- in-mvc-5.aspx

Answer 2

This behavior may be caused by improperly configured IIS Express.

Check your IISExpress settings. Either by pressing F4 in the project, or by editing the *.csproj project file.

• Set the Anonymous Authentication property to Enabled ;
• Set the Windows Authentication property to Disabled .

OR edit the configuration to:

 <PropertyGroup> <IISExpressAnonymousAuthentication /> <IISExpressWindowsAuthentication />