0

I am really having hard time working with Authorize; After checking the username and password of a registred user, the user should be redirected to the account page. In the account Controller I am using Authorize attribute as following:

    [Authorize]
    public ActionResult Index(string returnUrl)
    {
        ViewBag.ReturnUrl = returnUrl;
        return View();
    }

The thing is if I compile the code and try to login with the right username and password, I will get an HTML 401 unauthorized error which is wierd!.

I tried to read a bit about it, in a book of Jon Galloway called Professional ASP.NET MVC 5, he explained that Web.config should be also edited when using [Authorize] (i dont know if i got it right!). So i tried to edit Web.config as following:

<authentication mode="Forms">
  <forms loginUrl="~/Home/Login" timeout="2880"  />
</authentication>

Now, i dont get the error anymore but when I change the url, Iam able to see the account page without to login which is bad and means that [Authorize] attribute is not working.

I Know that Authorize works with Roles and Users, i could write for example [Authorize(Uers = "blabla")], But the thing in my application that all users that are registred in the EF DB are able to see the account page. Anyone can help me to solve this problem please:)?

Here you have the code of my login Form

[HttpPost]
    [AllowAnonymous]
    [ValidateAntiForgeryToken]
    public ActionResult Login(LoginViewModels lgm)
    {
        if (ModelState.IsValid)
        {
            // Check if username exist
            var dbUser = db.RegisterTables.FirstOrDefault(x => x.tUserName.ToLower().Equals(lgm.username));

            if (dbUser != null)
            {
                if (Security.IsCorrectPassword(lgm.password, dbUser))
                {
                    FormsAuthentication.SetAuthCookie(lgm.username, true);
                    return RedirectToAction("Index", "Account");
                }
                else ModelState.AddModelError("", "Check user or pass.");
            }
            else ModelState.AddModelError("", "Check user or pass.");
        }
        return View(lgm);
    }

The code of the /Account/Index is just a normal ActionResult thats returns the view of the account.

Tieson T.
  • 20,774
  • 6
  • 77
  • 92
Kob_24
  • 592
  • 1
  • 10
  • 26
  • Are you _sure_ you're not still logged in when it unexpectedly shows the account page? – user5151179 Oct 30 '15 at 00:12
  • If you have already logged in then you are "Authorized". You should be able to view the account page. What is the issue in here? – TejSoft Oct 30 '15 at 00:13
  • When i login i am not able to see the account page, i directly get this error Html error 401 unauthorized @TejSoft – Kob_24 Oct 30 '15 at 00:18
  • @user5151179 yes iam sure that am not still logged in because iam not moving forward to the next page, i directly get the html error as i mentioned before – Kob_24 Oct 30 '15 at 00:19
  • Post the code from your login method. There might be issue in there. – TejSoft Oct 30 '15 at 00:20
  • @TejSoft i edited my post so u can see the code, the Security.IsCorrecetPassword is my own class and method to check whether the hashed password is valid or not. – Kob_24 Oct 30 '15 at 00:26
  • Code looks alright to me. Did you debug and check that FormsAuthentication.SetAuthCookie(lgm.username, true); is being executed? Also the "Index" method is looking for a "returnUrl" as parameter. Can you remove it or assign a default value as empty string? – TejSoft Oct 30 '15 at 00:36
  • @TejSoft Yes i debugged it and Its working fine, and yes I did assigned it to null.. Same thing it won't work. – Kob_24 Oct 30 '15 at 00:40
  • @TejSoft The thing is when i remove this line i will have the unauthorized error again, so i think its something to do with the Web.Config file – Kob_24 Oct 30 '15 at 00:44
  • Bit strange. Check this question, might give a a clue: http://stackoverflow.com/questions/16665660/mvc-4-forms-authentication-not-working-with-authorize?rq=1 – TejSoft Oct 30 '15 at 01:07
  • @TejSoft Thanks bro, thats wierd the only thing was that i have to clear cookies from browser its working now.. – Kob_24 Oct 30 '15 at 06:28

0 Answers0