ASP.NET MVC authorization attribute behaves differently in IE and FireFox

Question

First of all: this is just a sample. It is not a question of whether this is a valid authentication method.

Basically, I get weird behavior that depends on the browser used. Everything works as expected in Firefox, but in IE the actions of the controller still work even when authorization fails.

I have an ASP.NET MVC test site where the SecureController class inherits from the standard Controller class with the following relevant code:

[AuthorizeByToken]
public class SecureController : Contrller
 protected override void OnAuthorization(AuthorizationContext filterContext)
 {
     // Check for presence of encoded session string
     if (filterContext == null) throw new ArgumentNullException("filterContext null");
     if (filterContext.HttpContext == null) throw new ArgumentNullException("httpContext null");
     if (filterContext.HttpContext.Request["TestToken"] == null) return;

     // Complete authorization
     FormsAuthentication.SetAuthCookie(csmSession.CSMUser.userName, true);
     base.OnAuthorization(filterContext);
 }

Also, the AuthorizeByTokenAttribute attribute is based on AuthorizeAttribute, for example:

public class AuthorizeByTokenAttribute : AuthorizeAttribute
{
    protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
    {
        filterContext.Result = new RedirectResult("/");
        filterContext.ActionDescriptor = null;
        base.HandleUnauthorizedRequest(filterContext);
    }

}

, , , http://testsite/TestSecureController/Index, Firefox. , . IE , , TestSecureController Index().

- , - ?

Answer 1

Uri . . - .

, cookie- , . :

• InPrivate IE8/IE9 - cooki . , , - , IE Firefox. , 2. , . 3.
• , IE; , cookie . , . 3.
• , , cookie Firefox IE . - http://ncookiereader.sourceforge.net/, cookie, Firefox IE, cookie Notepad ++. cookie , , , IIS, , , cookie , Web.config: <authentication mode="Forms"> <forms loginUrl="~/Account/LogOn" timeout="2880" protection="None" /> </authentication> - cookie , http://aaronstannard.com/ . cookie , 4.
• , Wireshark, , HTTP-, IE Firefox, - . , -.