ASP.NET MVC Beta Authorize attribute sends me to wrong action

Question

Today I started playing with the MVC 3 Beta. Started with an application from default MVC 3 template, added a new action in the Home controller as follows(with a view for it)

[Authorize]
public ActionResult Secured()
{
    ViewModel.Message = "This is secured area, only authenticated users should be here.";
    return View();
}

Now when I try to go to navigate to Secured action I get a 404 page not found error.

Here is the authentication section from my web.config.

<authentication mode="Forms">
  <forms loginUrl="~/Account/LogOn" timeout="2880" />
</authentication>

If I understood it right the Authorize attribute should result in a 401 unauthorized HTTP response which should be intercepted by the authentication handler and redirect me to the loginUrl. Which should result in Account/LogOn action.

My MVC 2 application works as expected and takes me to Account/LogOn action, am I missing something? or Is this a bug in MVC 3 beta?

It isn't just you - just had the same problem! – David Gardiner Oct 07 '10 at 00:27 — David Gardiner, Oct 07 '10 at 00:27

Fiacc · Answer 1 · 2011-05-01T19:53:22.737

15

It doesn't work with the RTM any more

You need to add

<add key="loginUrl" value="~/Account/LogOn" />

to the appSettings in the Web.Config

The issues is in ConfigUtil in WebMatrix.WebData

private static string GetLoginUrl()
{

    return ConfigurationManager.AppSettings[FormsAuthenticationSettings.LoginUrlKey] ?? FormsAuthenticationSettings.DefaultLoginUrl;
}



staticFormsAuthenticationSettings()
{
    LoginUrlKey = "loginUrl";
    DefaultLoginUrl = "~/Account/Login";
}

edited May 01 '11 at 19:53

answered Feb 18 '11 at 19:14

Fiacc

1,324
1
15
24

This fixed my application. Thanks for pointing this out. Cheers :) – Scott Arrington Apr 26 '11 at 23:18
1

Also note that adding "ASP.NET Web Pages with Razor syntax" using the new [Add Deployable Dependencies](http://msdn.microsoft.com/en-us/library/gg286946.aspx) option in Visual Studio will automatically include (regardless of whether you're using it) WebMatrix.WebData.dll in the generated _bin_deployableAssemblies directory, so you'll run into this issue when you deploy even if it "works on your machine". – Eric Bock Apr 29 '11 at 18:17

David Gardiner · Accepted Answer · 2010-10-07T22:01:57.673

10

ScottGu replies to a similar question on his blog that this is apparently a bug.

The workaround is to add this entry:

<add key="autoFormsAuthentication" value="false" />

to your <appSettings/> section in the web application's root web.config file.

edited Oct 07 '10 at 22:01

answered Oct 07 '10 at 01:13

David Gardiner

16,892
20
80
117

Thanks David, I'm glad me and Levi were able to find a bug in MVC 3 beta :). – Sai Puli Oct 07 '10 at 13:07
2

I'm using MVC 3 RTM and I found this bug crop up again and that appSettings key workaround doesn't fix it. Steps to reproduce: 1) Add new MVC 3 Website (with all the "Home", "Account" controller stuff. 2) Set [Authorize] to HomeController class. At this point, there is no issue - redirects to whatever is in web.config fine. However, if I 3) move _ViewStart.cshtml file to the root of the app (so all views in my areas will also use base layout), then I get the 404 Account/Login issue. I think it stems with the _ViewStart file. I've found several quirky things when using that feature. – tbehunin Feb 02 '11 at 21:39
2

This setting by itself did NOT fix the problem; I had to add as well for Windows Authentication to work. – Richard Morgan Sep 01 '11 at 15:41

score 2 · Answer 3 · answered Sep 27 '11 at 10:52

2

After I delete WebMatrix*.dll in bin directory, everything is OK.

answered Sep 27 '11 at 10:52

oneroan

21
1

1

I had an ASP.NET MVC 3 project that was built using the Razor view engine. Since our production server doesnt have ASP.NET MVC 3 installed, I copied the assemblies needed (including WebMatrix*.dll) to the bin folder during the deploy. We recently deployed an ASP.NET MVC 3 WebForms view engine app to production so I copied all of the assemblies from the Razor application so I didn't have to do it twice. That included the WebMatrix*.dll files. As soon as I removed those DLLs from my BIN folder, ALL of my troubles went away. How did you finally come to the conclusion to remove the WebMatrix dlls? – Nick Bork Nov 30 '11 at 16:50

score 0 · Answer 4 · edited Aug 12 '13 at 00:19

0

MVC 4 exhibits the same problem. However on MVC 4 if authentication mode is correctly set to ="Forms" in the configuration file, like in the following, the problem disappears:

<authentication mode ="Forms">
    <forms loginurl = "your login" timeout ="2880" slidingExpiration="true">
</authentication>

It works for me. Take out the mode and it gives you trouble.

edited Aug 12 '13 at 00:19

doppelgreener

4,809
10
46
63

answered Jan 16 '12 at 20:27

Farjad

257
4
9

ASP.NET MVC Beta Authorize attribute sends me to wrong action

4 Answers4

Linked