CODEWITHSUNDEEP
asp.net-mvcauthentication
yeomandev
yeomandev

Reputation: 11796

Why isn't my authentication cookie being set in MVC 4?

I've got an MVC4 project that I'm working on. When a user's login credentials are valid, I call FormsAuthentication.SetAuthCookie() to indicate that the user is logged in. (I have it wrapped in a class so I can mock the Interface for my unit tests.)

namespace FlashMercy.Shared.Security
{
    using System;
    using System.Web.Security;

    public class Auth : IAuth
    {
        public void SetAuthCookie(string userId, bool remember)
        {
            FormsAuthentication.SetAuthCookie(userId, remember);
        }

        public void Signout()
        {
            FormsAuthentication.SignOut();
        }
    }
}

In the debugger, I can confirm that the .SetAuthCookie(userId, remember) line is executing, and userId is populated.

Then, I have a custom authorize attribute to check that the user is logged in:

namespace FlashMercy.Shared.Security
{
    using System.Web.Mvc;

    public class FlashMercyAuthorizeAttribute : AuthorizeAttribute
    {
        public override void OnAuthorization(AuthorizationContext filterContext)
        {
            if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
            {
                filterContext.Result = new RedirectResult("/");
            }
        }
    }
}

When I debug the application, the filterContext.HttpContext.User.Identity.IsAuthenticated is false even after I've supposedly set the auth cookie. Also, filterContext.HttpContext.User.Identity.Name is empty. I'm not sure what I'm missing here.

Update

If you care to look at the whole source, it's available on GitHub: https://github.com/quakkels/flashmercy.

Upvotes: 1

Views: 1902

Answers (3)

Sergey Litvinov
Sergey Litvinov

Reputation: 7458

Problem with your code is that you are using FormsAuthentication, but you didn't add it to web.config. Your web.config should have such section:

<system.web>
    <authentication mode="Forms"></authentication>
    ...
</system.web>

Based on this Mode Asp.Net understand what authentication mode it should use, e.g. Forms, Windows, etc. And without settings it to Forms value - FormsAuthenticationModule just ignores .ASPXAUTH cookie from the request.

PS. I've downloaded your code, and with correct authentication section in web.config it works fine and updates HttpContext.User.Identity.IsAuthenticated to true.

Upvotes: 1

Erik Philips
Erik Philips

Reputation: 54628

filterContext.HttpContext.User.Identity.IsAuthenticated is false even after I've supposedly set the auth cookie.

This will always be the case if you do not redirect after SetAuthCookie(). The ASP.Net pipeline is in charge of authorizing the user (most of the time before we write code) in the AuthenticateRequest. Setting a Cookie does not update the current User.Identity, this requires code that has already been executed. Just make sure anytime you SetAuthCookie() you immediately redirect (server side is fine) to another URL (probably should anyway, its a good way to seperate logging in a user, and what they should do next SRP).

Upvotes: 0

jgauffin
jgauffin

Reputation: 101150

The problem is that you only set the authentication cookie but do not have anything that load it.

It's forms authentication that uses that cookie. So you either have to activate forms authentication or you'll have to load it yourself.

Upvotes: 0

Related Questions