MVC 4 Using Authorize with Custom Code Not Working

Question

New to MVC 4. What I do not want to do is used the built-in Account management that comes with MVC 4. However, I have created an Account folder under Views, an AccountModel, and AccountController.

What I would like to do is restrict access to Views within the Account folder. for this, in my AccountController, I use the following:

[Authorize]
public class AccountController : Controller
{
    [AllowAnonymous]
    public ActionResult Login(string returnUrl)
    {
        ViewBag.ReturnUrl = returnUrl;
        return View();
    }
    public ActionResult bob()
    {
        return View();
    }...

On my home page, I have a link to the bob view under the Accounts view which now reroutes me to the login page (which is correct).

Now, upon form submittal, with the right credentials (anything goes) I should be able to see bob, but instead I am redirected back to the Login because I was not authorized. The code:

    public ActionResult Login(LoginModel model, string returnUrl)
    {
        if (ModelState.IsValid)
        {
            return RedirectToLocal(returnUrl);
        }...

I do not want to use the built-in connect to the DB, but rather what do I need to check the username against a string and then keep an authorization = true so that I can view bob?

In the long run, I plan on connecting to a DB and pulling info back with a SPROC, so right now, I just want the user to be authenticed based upon a string that is checked.

Answer 1

You continue to be Redirected until ASP.net sees a Forms Authenticated cookie.

FormsAuthentication.SetAuthCookie(theUsersNameasString, boolForSessionOrPersistentCookie);

Assuming your Web.Config is configured for Forms Authentication

 <authentication mode="Forms">
  <forms loginUrl="~/Account/Login" timeout="2880" />
</authentication>

ASP.Net will look for .ASPXAUTH cookie unless the name of this cookie was altered in WEB.CONFIG