没有显式登录的ASP.NET登录重定向

Question

ASP .NET 4.0 with MVC 3.0

So here's the situation: I am new to MVC and ASP.NET and I have a MVC application that uses FormAuthentication with the following in the web.config :

<authentication mode="Forms">
   <forms loginUrl="~/LogOn/LogOn" timeout="2" requireSSL="true" />
</authentication>

And what usually happens is that if a user navigates to a page after the session has expired, they are directed to the LogOn page, which works fine. What I am trying to do is prevent that page from being sent back if the request is an Ajax call and instead send an JSON object back to indicate failure.
I've gotten as far as catching the request, checking for the XMLHttp type via the below:

void MvcApplication_AuthenticateRequest(object sender, EventArgs e)
{
        if (s_identityProvider == null)
            return;
        IClaimsPrincipal principal = GetClaimsPrincipal();
        Context.User = principal;
        if (principal != null)
            ClaimProvider.CheckAndPopulateRoles(principal);
        else
        {
            if (Context.Request.Headers["X-Requested-With"] == "XMLHttpRequest")
            {
                Context.Response.Write( "<?xml version='1.0' encoding='ISO-8859-1'?>"+
                                        "<note>"+
                                        "</note>";
            }
            else
            {
                FormsAuthentication.SignOut();
            }
        }
}

Now, I've tested that my check for AJAX call seems to work, the only thing that is bizarre is that after the catch, the login page is STILL sent as a response. I have checked for all uses of FormsAuthentication methods to make sure no one else is forcing a FormsAuthentication.RedirectToLoginPage() and checked, in fact, all uses of FormsAuthentication and none are doing anything bizarre. I've also checked for the query for the login page URL (via GetRedirectUrl() ) and still nothing.

Does anyone have any ideas what would be doing the autoredirect?

Answer 1

My only guess would be that the AuthenticateRequest method is not the end of the Request's life cycle here. As a result, the Response that is ultimately returned to the user is the redirect response. You should try explicitly ending the Response after you have caught and modified the AJAX response to avoid any further manipulation by the MVC framework

if (Context.Request.Headers["X-Requested-With"] == "XMLHttpRequest")
{
    Context.Response.Write( "<?xml version='1.0' encoding='ISO-8859-1'?>"+
                            "<note>"+
                            "</note>";
    Context.Response.End(); // Calling End here should complete the response.
 }
 else {
            // ... other stuff
 }