ASP.NET Authentication Using [Authorize]
I have defined a controller to force authentication using the [Authorize] attribute. When the session expires, the request is still forwarded and executed instead of forcing a redirect.
I am using FormsAuthentication for login and logout.
Any ideas on how to control this?
Example:
[Authorize]
public class ProjectsController : Controller
{
public ActionResult Index()
{
return View();
}
}
source to share
Again, ASP.NET MVC is built on top of traditional ASP.NET. Yes, there is a "built-in authentication spike" ... this is the same membership API that traditional ASP.NET uses.
Meaning ... something else is a problem here. Maybe you've enabled rolling sessions ... or maybe the timeout is higher than you thought, etc.
source to share
ASP.NET uses the ASP.NET_SessionId cookie to track user sessions. ASP.NET uses the ASPXAUTH cookie (default) to track authenticated users.
When the session ends, the ASP.NET_SessionId cookie can no longer be sent by the client, but the ASPXAUTH cookie is still being sent, which may explain why your action is being displayed.
To override the default authentication values, you can look here . I also suggest you use the firebug extension to see exactly which cookies are being sent by the client.
source to share