Cannot view home page as guest user (even with AllowAnonymous)

Question

New to working with C# .NET, bear with me.

I'm building a simple C# web app (MVC 4). My authentication/authorization works - normal users can login/logoff/view data, only admins can edit database, etc. However, a guest user cannot view the home page. Instead guest is redirected to login page - something I specified in web.config. (Before I implemented that, user just goes to error page.). Only when a user is logged in can they actually see the home page.

For some reason, including [AllowAnonymous] on the appropriate action (Index()) in my HomeController doesn't work, whereas doing the same for an action in a different controller does work for guest users (e.g. the login page shows).

Removing [Authorize] and/or [AllowAnonymous] doesn't work. I also tried using Application_BeginRequest() in Global.asax but no success (not even sure if I'm using that correctly). Could someone help me understand why the homepage would be blocked? No other page has access problems.

HomeController.cs:

...
namespace Portal.UI.Controllers
{
    [Authorize]
    public class HomeController : Controller
    {
        [AllowAnonymous]
        public ActionResult Index()
        {
            return View();
        }
        ...
    }
}

web.config:

<system.web>
    <authentication mode="Forms">
      <!-- Login action is in another controller, AdminController -->
      <forms name="REDIRECT_TO_LOGIN" loginUrl="~/Admin/Login"
        protection="All" path="/" timeout="30">
      </forms>
    </authentication>
</system.web>

Global.asax.cs:

public class MvcApplication : System.Web.HttpApplication
{
    protected void Application_Start()
    {
        // ...
        AreaRegistration.RegisterAllAreas();

        WebApiConfig.Register(GlobalConfiguration.Configuration);
        FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters);
        RouteConfig.RegisterRoutes(RouteTable.Routes);
    }

    protected void Application_BeginRequest()
    {
        if (Request.AppRelativeCurrentExecutionFilePath == "~/")
            HttpContext.Current.RewritePath("/Home/Index");
    }
}

Have you tried moving the [Authorize] attribute to the method level? Right now, you are forcing an authorize on the whole class, including the home page. — marcellscarlett, Jun 26 '13 at 19:06
Moving it doesn't work. Even if [Authorize] is on the whole class, [AllowAnonymous] should allow me to whitelist the actions. (as per http://stackoverflow.com/questions/9727509/how-to-allow-anonymous-user-access-to-some-page-in-mvc) — Nondeterministic narwhal, Jun 26 '13 at 19:23
Is there possibly a component on your homepage that makes a call to a protected controller action? — marcellscarlett, Jun 26 '13 at 19:26
I have no protected controller actions. (I'm also updating my question a bit) — Nondeterministic narwhal, Jun 26 '13 at 21:19
I have edited your title. Please see, "[Should questions include “tags” in their titles?](http://meta.stackexchange.com/questions/19190/)", where the consensus is "no, they should not". — John Saunders, Jun 26 '13 at 21:44

score 0 · Accepted Answer · answered Jun 28 '13 at 21:36

0

False alarm - turns out I modified the default behavior of the ControllerFactory a while back, and that caused my HomeController actions to never be executed. It's all good now.

answered Jun 28 '13 at 21:36

Nondeterministic narwhal

480
5
17

Cannot view home page as guest user (even with AllowAnonymous)

1 Answers1