i have a problem with a net web app and Authorization.
I have an area of my site where you need to be authenticated. Some methods that return page (html) and data (json) to the client has [Authorize] attribute.
Signature Example
[Authorize]
public async Task<JsonResult> GetListaLogin(Guid IDMovScheda)
So when you try to access that area, you're redirected to login page. Login Page Image
Take note of /fakesite lower case
Login Page Authorization will use cookie. Here's the code:
//omitted: checking if login is ok
AuthenticationProperties authProperties = new AuthenticationProperties
{
AllowRefresh = true ,
RedirectUri = login.ReturnUrl,
IsPersistent = login.RememberMe,
};
IEnumerable<Claim> claims = GetUserClaims(loginRow);
ClaimsIdentity identity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
ClaimsPrincipal principal = new ClaimsPrincipal(identity);
await httpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, principal, authProperties);
The code above generate a security cookie. Cookie Image
Take note of /fakesite lower case
When I try to access some data, building the url with uppercase /FakeSite Request Image, the security cookie is not sent in the request and the response is 401 unauthorized.
If i start again but I put from the start /FakeSite, then the security cookie path is /FakeSite and the cookie is sent in the request, all is ok.
I would like to know if Authorization Cookie is case sensitive and how I can avoid this behaviour and always authenticate user, regardless from how you write lower or upper /fakesite