asp.net mvc 401 Unauthorized error after redirect

Question

I'm getting the 401 Unauthorized error after user is redirected.

User is being redirected to another page after a new user created.

public ActionResult SaveUser(UserViewModel userViewModel)
{
    ModelState.Remove("IsDSA");
    ModelState.Remove("IsAccountRepresentative");

    var savedUser = SaveOrUpdateUser(ref userViewModel);

    TempData["Status"] = ViewBag.Status;
    TempData.Keep("Status");

    var MenuId = Request.QueryString["MenuID"];

    TempData["MenuId"] = MenuId;
    TempData.Keep("MenuId");

    if (userViewModel.AddAnotherUserRequseted && savedUser != null)
    {

        return RedirectToAction("CreateNewUser", new { MenuID = Request.QueryString["MenuID"] });
    }

    return RedirectToAction("UserAccessManagement", "UserAccessManagement", new { MenuID = Request.QueryString["MenuID"] });
}

public ActionResult UserAccessManagement(string TabName, long MenuID)
{
    ...
}

How can I fix this error? Maybe the reason is that authentication cookies are not sent with the redirect?

Answer 1

It is because you forget Authorize attribute on controller

[Authorize]
public class UserAccessManagement: Controller {
    public ActionResult Index() {
        return View();
    }
}

Answer 2

So after a full day of investigation I started to doubt that reason may be in the Authorize Attribute or global filters and began thinking that maybe IIS somehow returns 401 on the redirect requests. But some of other actions with RedirectToAction were found by me and they worked. Besides versions hosted on another IIS had the same problem

Then I started to wonder if there is any Authorization configuration in the MVC project other then default and searched through the project "authorize" which didn't give any unexpected results

But then an idea came up to me to search through all the solution the "redirect" phrase and I finally found the root of the issue...

So on the Application_EndRequest the StatusCode is set to 401 and the error returned for the wrong type of the request

I guess searching for "401" would also help and if the constants were named they would have been found earlier