ASP.NET Authentication Using [Authorize]
I have defined a controller to force authentication using the [Authorize] attribute. When the session expires, the request is still forwarded and executed instead of forcing a redirect.
I am using FormsAuthentication for login and logout.
Any ideas on how to control this?
Example:
[Authorize]
public class ProjectsController : Controller
{
public ActionResult Index()
{
return View();
}
}
Again, ASP.NET MVC is built on top of traditional ASP.NET. Yes, there is a "built-in authentication spike" ... this is the same membership API that traditional ASP.NET uses.
Meaning ... something else is a problem here. Maybe you've enabled rolling sessions ... or maybe the timeout is higher than you thought, etc.
ASP.NET uses the ASP.NET_SessionId cookie to track user sessions. ASP.NET uses the ASPXAUTH cookie (default) to track authenticated users.
When the session ends, the ASP.NET_SessionId cookie can no longer be sent by the client, but the ASPXAUTH cookie is still being sent, which may explain why your action is being displayed.
To override the default authentication values, you can look here . I also suggest you use the firebug extension to see exactly which cookies are being sent by the client.
Based on your other question, I would suggest that you are not getting into this controller at all.