授权行为不一致

Question

I have an ASP.NET MVC5 application. I have a controller called AjaxController . There is a method SaveComment which is not decorated with [Authorize] attribute. The controller itself is not attributed with the above class as well. Basically the code is as follows

public class AjaxController : BaseController {
    public ActionResult SaveComment(CommentViewModel viewModel) {
        // stuff
    }
    // stuff
}

public abstract class BaseController : Controller {
    // some comment stuff
}

And this is the Web.config setup

<authentication mode="Forms">
  <forms loginUrl="/Login" timeout="20" slidingExpiration="true" />
</authentication>

But when I request it from the browser, it redirects me to the login page. What can be the reason of a such behavior?

I don't override the OnActionExecuted and OnActionExecuting and methods do something with authentication pipeline either.

A few more details: I have two more controllers HomeController and LoginController which are working perfect without authorization. Also I have another controller that forces authorization MyController , and the class itself decoraded with Authorize , and when I tried to decorate some action with AllowAnonymous , the attribute was ignored and it redirected to the login page.

Answer 1

Can you please try this:

<add key="autoFormsAuthentication" value="false" />
<add key="enableSimpleMembership" value="false"/>

Hope this helps..