奇怪的ASP.NET表单身份验证问题

Question

On my default.aspx is a login page :

Default.aspx :

<%@ Page Language="C#" AutoEventWireup="true" CodeBehind="Default.aspx.cs" Inherits="Portal.Default"
    MasterPageFile="Portal.Master" Title="Login" %>

<asp:Content runat="server" ContentPlaceHolderID="MainContentPlaceHolder">
    <div class="block" id="login">
        <h2>Login</h2>
        <asp:Label style="top: 15px;left: 11px" runat="server" Text="User Name :" CssClass="label" />
        <asp:TextBox ID="txtLoginUserName" Style="top: 15px;left: 17px; width:100px" runat="server"  CssClass="textbox" />
        <asp:Label style="top: 20px;left: 19px;" runat="server" Text="Password :" CssClass="label" />
        <asp:TextBox ID="txtLoginPassword" Style="top: 20px;left: 25px; width:100px;"  runat="server" TextMode="Password" CssClass="textbox" />
        <asp:Button ID="btnLogin" Style="top:30px;left: 91px" CssClass="button" runat="server" Text="Login" OnClick="BtnSubmitClick" />
    </div>
</asp:Content>

Code behind :

using System;
using System.Linq;
using System.Web.Security;

namespace Portal
{
    public partial class Default : System.Web.UI.Page
    {
        protected void Page_Load(object sender, EventArgs e)
        {
            Page.Form.DefaultFocus = txtLoginUserName.ClientID;
        }

        protected void BtnSubmitClick(object sender, EventArgs e)
        {
            using (var db = new DbContext())
            {
                if (db.Users.Any(x => x.Username == txtLoginUserName.Text && x.Password == txtLoginPassword.Text))
                {
                    FormsAuthentication.RedirectFromLoginPage(txtLoginUserName.Text, true);
                }
                else
                {
                    ClientScript.RegisterStartupScript(GetType(), "myalert", "alert('* invalid credentials, please try again');", true);
                }
            }
        }
    }
}

Web.Config :

<?xml version="1.0" encoding="utf-8"?>
<!--
  For more information on how to configure your ASP.NET application, please visit
  http://go.microsoft.com/fwlink/?LinkId=169433
  -->
<configuration>

  <location path="default.aspx">
    <system.web>
      <authorization>
        <allow users="?" />
      </authorization>
    </system.web>
  </location>

  <location path="Styles">
    <system.web>
      <authorization>
        <allow users="?" />
      </authorization>
    </system.web>
  </location>

  <location path="Console.aspx">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>

  <location path="Options.aspx">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>

  <system.web>

    <authorization>
      <deny users="?" />
    </authorization>

    <authentication mode="Forms">
      <forms name="Portal" loginUrl="default.aspx" defaultUrl="console.aspx" />
    </authentication>

    ...

  </system.web>

</configuration>

The problem is when I go to my website, instead of http://www.myhostname.com/default.aspx it takes me to http://myhostname.com/default.aspx?ReturnUrl=%2f which is strange, so I type in the username and password, hit login... and everything goes blank... the url changes to http://www.myhostname.com and I type everything a 2nd time... after which it logs in... and goes to console.aspx

Why is it doing that?

Answer 1

As specified here

http://msdn.microsoft.com/en-US/library/s09bfdt2(v=vs.80).aspx

FormsAuthentication.RedirectFromLoginPage

Redirects an authenticated user back to the originally requested URL or the default URL.

ReturnUrl=%2f

for your first login and the default url for the second

Answer 2

I solved the issue thus:

1. Renamed default.aspx to login.aspx and updated all refs.
2. Renamed the console.aspx as default.aspx and updated all refs.

Now I changed the web.config to look much simpler like so :

<?xml version="1.0"?>
<!--
  For more information on how to configure your ASP.NET application, please visit
  http://go.microsoft.com/fwlink/?LinkId=169433
  -->
<configuration>
  <system.web>

    <authorization>
      <deny users="?"/>
    </authorization>

    <authentication mode="Forms">
    </authentication>

    ...

  </system.web>  
</configuration>

Now it works on the first login, and I am well happy with all that simplification :D