未经授权时不重定向到登录

Question

I have an ASP.NET Core web application and I am decorating a few controller action methods with Authorize attribute.

So, when I am not logged in, it doesn't do any redirect and only shows me a blank page for that controller action. I have gone through a couple of tutorials and they talk about Cookie authentication. Below is my Configure method in Startup.cs.

public void Configure(IApplicationBuilder app, IHostingEnvironment env, 
    ILoggerFactory loggerFactory)
{
    loggerFactory.AddConsole(Configuration.GetSection("Logging"));
    loggerFactory.AddDebug();

    app.UseApplicationInsightsRequestTelemetry();
    app.UseCookieAuthentication(new CookieAuthenticationOptions
    {
        AuthenticationScheme = "MainCookie",
        LoginPath = "/Login",
        AccessDeniedPath = "/Home/Forbidden/",
        AutomaticAuthenticate = true,
        AutomaticChallenge = false
    });
    app.UseCookieAuthentication(new CookieAuthenticationOptions
    {
        AuthenticationScheme = "ExternalCookie",
        AutomaticAuthenticate = false,
        AutomaticChallenge = false
    });
    app.UseGoogleAuthentication(new GoogleOptions()
    {
        ClientId = "*****",
        ClientSecret = "*****",
        SignInScheme = "ExternalCookie"
    });
    app.UseFacebookAuthentication(new FacebookOptions()
    {
        SignInScheme = "ExternalCookie",
        AppId = "AppId",
        AppSecret = "AppSecret"
    });
    app.UseLinkedInAuthentication(new LinkedInOptions()
    {
        SignInScheme = "ExternalCookie",
        ClientId = "*****",
        ClientSecret = "*****",
        ProfileScheme = LinkedInDefaults.ProfileLoadFormat.AppDefined
    });

    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
        app.UseBrowserLink();
    }
    else
    {
        app.UseExceptionHandler("/Home/Error");
    }

    app.UseApplicationInsightsExceptionTelemetry();

    app.UseStaticFiles();

    app.UseSession();
    app.UseMvc(routes =>
    {
        routes.MapRoute(
            name: "default",
            template: "{controller=Home}/{action=Index}/{id?}");
    });
}

My action here,

[Authorize]
[HttpGet("/questions/ask", Name = "askquestions")]
public IActionResult Ask()

Answer 1

Looks like you're expected to see login page, if the user is not authenticated Since you configured AutomaticChallenge property to false, you won't redirect to the login page. This behaviour is by design. More details here