ASP.NET Authenticate Using [Authorize]

Question

I defined a Controller to force authentication by using the [Authorize] attribute. When a session times out, the request is still passed down and executed instead of forcing a redirect.

I do use FormsAuthentication to login and logoff users.

Any ideas on how to control that?

Example:

[Authorize]
public class ProjectsController : Controller
{
    public ActionResult Index()
    {
        return View();
    }
}

I was going to ask this question separately, but as we're here, does ASP.NET MVC have inbuilt authentication shizzle? Thanks in advance. — asleep
– asleep, Commented Nov 30, 2008 at 17:38
In a quick and dirty test, this worked fine for me. Can you post your Web.Config file? — MrJavaGuy
– MrJavaGuy, Commented Nov 30, 2008 at 18:01
my web.config is standard out of the box with the simple addition of: <authentication mode="Forms"> <forms loginUrl="~/Account/Login"/> </authentication> — IEnumerator
– IEnumerator, Commented Nov 30, 2008 at 18:04

Timothy Khouri · Accepted Answer · 2008-11-30 20:51:51Z

1

Again, ASP.NET MVC builds on top of traditional ASP.NET. Yes, there is an "built authentication shizzle"... it's the exact same Membership API that traditional ASP.NET uses.

Meaning... something else is the problem here. Maybe you have sliding sessions turned on... or maybe the timeout is higher than you thought, etc.

answered Nov 30, 2008 at 20:51

Timothy Khouri

32k21 gold badges94 silver badges129 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

IEnumerator Over a year ago

i had to turn off sliding sessions and it seems to of resolved it.

Darin Dimitrov · Accepted Answer · 2008-11-30 18:08:08Z

1

To track user sessions ASP.NET uses the ASP.NET_SessionId cookie. To track authenticated users ASP.NET uses the ASPXAUTH cookie (by default).

When a session times out the ASP.NET_SessionId cookie might no longer be sent by the client but the ASPXAUTH cookie is still sent which might explain why your action is rendered.

To override default forms authentication values you might take a look here. I also suggest you to use the firebug extension to see exactly which cookies are sent by the client.

answered Nov 30, 2008 at 18:08

Darin Dimitrov

1.0m275 gold badges3.3k silver badges3k bronze badges

Comments

Community · Accepted Answer · 2017-05-23 12:13:33Z

0

Based on your other question, I would guess you are not getting to this controller at all.

edited May 23, 2017 at 12:13

CommunityBot

11 silver badge

answered Nov 30, 2008 at 18:12

MrJavaGuy

6764 silver badges8 bronze badges

2 Comments

IEnumerator Over a year ago

i get into the controller but i am stuck within the Index method so i can't use the same controller for other methods because they all post back to the Index method. Example: a path like /projects/edit/1 would post the form to ProjectController method Index()

MrJavaGuy Over a year ago

Sounds like you have either a form within a form on your page, or a bad routing setup. Can you post your routes and the view source from the page in question?

Collectives™ on Stack Overflow

ASP.NET Authenticate Using [Authorize]

3 Answers 3

1 Comment

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related