ASP.Net Core - Authorize Method doesn't work, it logs out the user

Viewed 32

I have been trying to use the authorization method to limit access to specific actions and pages to users that are not logged in. In this case, I am trying to prevent users who are not logged in from purchasing books on my website. Here is how I used the authorize method.

// GET: Books/Purchase/5
        [Authorize]
        public async Task<IActionResult> Purchase(Guid id)
        {
            if (id == null)
            {
                return NotFound();
            }

            var book = await _context.Book.FindAsync(id);

            if (book == null)
            {
                return NotFound();
            }
            OrderViewModel model = new OrderViewModel();
            model.BookOrder = book;
            model.Quantity = 1;
            return View(model);
        }

When I try to purchase a book the browser takes me back to the login page even though I am already logged in as an admin. What could be the reason for this? Here is my login action:

[HttpPost]
    [AllowAnonymous]
    public async Task<IActionResult> Login(LoginViewModel model, string returnUrl)
    {
        if (ModelState.IsValid)
        {
            var result = await signInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, false);

            if (result.Succeeded)
            {
                if (!string.IsNullOrEmpty(returnUrl))
                {
                    return LocalRedirect(returnUrl);
                }
                return RedirectToAction("index", "home");
            }
        }
        ModelState.AddModelError("", "Invalid Login Attempt");
        return View(model);
    }

Any help/guidance with this?

1 Answers

One reason is that the order of app.UseAuthentication(); and app.UseAuthorization(); is reversed.

You need to make sure app.UseAuthorization(); is after app.UseAuthentication();.

More details you can refer to Asp.Net Core identity.

Related