Application redirects to login.aspx page

Question

I am working on a application where unauthenticated users will be directed to my /Account/login.cshtml page, where they will be required to log in with a name and password stored in my database. (Individual Authentication).

What Have I done

So far, I have set up authentication and connection to my database and login works fine. However, when I try to set my login page I am redirected to login.aspx. I have added the following to my webconfig and something strange occurs.

<authentication mode="Forms">
  <forms loginUrl="~/Account/Login"  />
</authentication>

With the above,when I run my program this is what i am redirected to.

http://localhost:64998/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/Account/Login?ReturnUrl=/

however if i change the link to /Account/test (a page that doesnt exist) I get an error of the page doesnt exist as i expect. So im wondering if there's something wrong with my Account/Login?

I dont believe anything is wrong with my login.cshtml page, because if I call it explicitly I can log in fine. The problem occurs when I am trying to redirect to this page when I am not authenticated.

Any help as to where to watch would be appeciated.

UPDATE Login in account Controller

   public UserManager<ApplicationUser> UserManager { get; private set; }

        //
        // GET: /Account/Login
        [AllowAnonymous]
        public ActionResult Login(string returnUrl)
        {
            ViewBag.ReturnUrl = returnUrl;
            return View();
        }

        //
        // POST: /Account/Login
        [HttpPost]
        [AllowAnonymous]
        [ValidateAntiForgeryToken]
        public async Task<ActionResult> Login(LoginViewModel model, string returnUrl)
        {

App Settings part of Web Config

  <appSettings>
    <add key="PreserveLoginUrl" value="true" />
    <add key="webpages:Version" value="3.0.0.0" />
    <add key="webpages:Enabled" value="false" />
    <add key="ClientValidationEnabled" value="true" />
    <add key="UnobtrusiveJavaScriptEnabled" value="true" />
  </appSettings>

 <runtime>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="WebGrease" publicKeyToken="31bf3856ad364e35" />
        <bindingRedirect oldVersion="0.0.0.0-1.5.2.14234" newVersion="1.5.2.14234" />
      </dependentAssembly>
      <dependentAssembly>
        <assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" />
        <bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" />
      </dependentAssembly>
      <dependentAssembly>
        <assemblyIdentity name="System.Web.WebPages" publicKeyToken="31bf3856ad364e35" />
        <bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" />
      </dependentAssembly>
      <dependentAssembly>
        <assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" />
        <bindingRedirect oldVersion="1.0.0.0-5.2.3.0" newVersion="5.2.3.0" />
      </dependentAssembly>
    </assemblyBinding>
  </runtime>

Further Testing

After more testing I realize that, commenting out the following code causes the application work to fine. But I still that dont think that is a solution as absent it my session doesnt expire.

code is question is in my FilterConfig and called in RegisterGlobalFilters

  public class SessionExpireFilterAttribute : ActionFilterAttribute
    {

        public override void OnActionExecuting(ActionExecutingContext filterContext)
        {
            HttpContext ctx = HttpContext.Current;
            // check if session is supported
            if (ctx.Session != null)
            {

                // check if a new session id was generated
                if (ctx.Session.IsNewSession)
                {

                    // If it says it is a new session, but an existing cookie exists, then it must
                    // have timed out
                    string sessionCookie = ctx.Request.Headers["Cookie"];
                    if ((null != sessionCookie) && (sessionCookie.IndexOf("ASP.NET_SessionId") >= 0))
                    {
                        string redirectOnSuccess = filterContext.HttpContext.Request.Url.PathAndQuery;
                        string redirectUrl = string.Format("?ReturnUrl={0}", redirectOnSuccess);
                        string loginUrl = FormsAuthentication.LoginUrl + redirectUrl;
                        if (ctx.Request.IsAuthenticated)
                        {
                            FormsAuthentication.SignOut();
                            HttpContext.Current.Session.Abandon();

                            // clear authentication cookie
                            HttpCookie cookie1 = new HttpCookie(FormsAuthentication.FormsCookieName, "");
                            cookie1.Expires = DateTime.Now.AddYears(-1);
                            HttpContext.Current.Response.Cookies.Add(cookie1);

                            // clear session cookie (not necessary for your current problem but i would recommend you do it anyway)
                            HttpCookie cookie2 = new HttpCookie("ASP.NET_SessionId", "");
                            cookie2.Expires = DateTime.Now.AddYears(-1);
                            HttpContext.Current.Response.Cookies.Add(cookie2);
                        }
                        RedirectResult rr = new RedirectResult(loginUrl);
                        filterContext.Result = rr;
                        //ctx.Response.Redirect("~/Home/Logon");
                    }
                }
            }

            base.OnActionExecuting(filterContext);
        }

    }

Answer 1

You need to allow anonymous access to your login page. Right now, if a user that's not logged in yet hits any page, including the login page , they are redirected to the login page, where they are still not logged in and so are redirected again, and again, and again, etc.

You can do this by replacing the [Authorize] attribute on the page and actions in the controller with [AllowAnonymous] .