Identity: After "force"-account-login(without providing password), normal logging in way(with password) stops working

Viewed 144

So,

I'm logging into an account using

await _signInManager.SignInAsync(user, true);

It allows me to login without password - basically Force.

then after a while I'm going to login form, filling login/password fields, sending POST and logging via this code:

var result = await _signInManager.PasswordSignInAsync(input.UserName, input.Password, false, lockoutOnFailure: true);

It evaluates as a true

but for some reason I'm still unauthorized.

I figured out that when I remove this cookie:

enter image description here

Then everything works properly.

So, I wanted to perform a "hack" and while returning LoginFormView I added that to controller's method

await _signInManager.SignOutAsync();
foreach (var cookie in Request.Cookies.Keys)
{
    if (cookie == "MyApp")
    {
        Response.Cookies.Delete("MyApp");
        Response.Cookies.Append("MyApp", "", new CookieOptions { HttpOnly = true, Expires = new DateTimeOffset(new DateTime(1970, 1, 1)) });
    }
}

But it doesn't really solve my issue.

That's my cookie config

services.ConfigureApplicationCookie(options =>
{
    options.AccessDeniedPath = "/Login";
    options.Cookie.Name = "MyApp";
    options.LoginPath = "/Login";
    options.LogoutPath = "/Logout";
    options.Cookie.Path = "/";
    options.Cookie.HttpOnly = true;
    options.ExpireTimeSpan = TimeSpan.FromMinutes(600);
    options.ReturnUrlParameter = CookieAuthenticationDefaults.ReturnUrlParameter;
    options.SlidingExpiration = true;
});

Anybody has an idea how to make it work?

0 Answers
Related