渲染默认视图后，AspNet MVC使我弹回登录

Question

After a successful login using Aspnet Identity (SignInStatus.Success), MVC goes through the entire code of the default action and view, but then mysteriously bounces me back to the login page.

Strangely, this only happens with one of my user roles. I have two roles, admin and editor . admin works fine. editor USED to work.

Here's my default view authorization code...

[Authorize(Roles = "Admin, Editor")]
public ActionResult Index()
{ ...

If anyone could suggest what the problem could be, or how I could debug it, that would be much appreciated. I've hit a brick wall. The debugger steps without errors right through the action code, the view code, and the layout code right to the last line of Razor in the layout, which is

@RenderSection("Scripts", required: false) 

I've tried it on two different browsers. I thought it might be an issue with the anti-forgery token. I did get the following message once... "The provided anti-forgery token was meant for a different claims-based user than the current user".

But I think this was just a glitch from so many login attempts during debugging.

I'm running... VS 2015 .NET Framework 4.5.2 Microsoft.AspNet.Identity.Core, Microsoft.AspNet.Identity.EntityFramework, Microsoft.AspNet.Identity.Owin all version 2.2.1

Any help would be much appreciated.

Answer 1

Even though the controller and the view authorized the Editor role, my layout was calling an action in another controller using

@Html.Action(...

That controller had

[Authorize(Roles = "Admin")]

above its class definition.

Hence DotNet decided (even though it had continued through the rendering code for the entire view and layout) to bounce back to the login page.

Thanks to @MarkHomer. His comment gave me the idea to look for this.

I fixed the problem by putting [Authorize(Roles = "Admin,Editor")] above the class definition and then setting [Authorize(Roles = "Admin")] for individual actions that only needed admin access.

Answer 2

You must be redirecting the user to a RedirectURL post successful login. Have you checked that your logged-in user persists during this redirection or once it gets to the redirected URL.