ASP.NET Core [Authorize] asking to log in page a recent logged in USER

Question

I'm on ASP.NET Core 3.1, using Identity EF with a custom ApplicationUser which had 3 extra properties for track.

I am facing a problem with the [Authorize] attribute.

When you access to the HomeController which has the [Authorize] decoration, the user will reach and get the respective view with no problems.

But when it try to do it on a second controller (HistoricosController), which also has the [Authorize] applied, the user will be taken to the login page, and asked to log in again. After that, he will be able to get in with out the need of log in again.

I had already investigated why my [Authorize] attribute is acting like this with no success. Here are some things which I already have taken in consideration with no results:

Checked the order of the app.UseRouting | app.UseAuthentication | app.UseAuthorization | app.UseEndpoints
Added the services.AddAuthentication() and services.AddAuthorization() middlewares

My ConfigureServices method:

public void ConfigureServices(IServiceCollection services)
{
        services.AddDbContext(options =>
        {
            options.UseSqlServer(Configuration.GetConnectionString("ApConectionString2"));
        });

        services.AddIdentity(options =>
         {
             options.SignIn.RequireConfirmedAccount = false;
             options.SignIn.RequireConfirmedEmail = false;
             options.SignIn.RequireConfirmedPhoneNumber = false;
             options.Password.RequireDigit = true;
             options.Password.RequiredUniqueChars = 0;
             options.Password.RequireLowercase = false;
             options.Password.RequireUppercase = false;
             options.User.AllowedUserNameCharacters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._@";
         })
        .AddEntityFrameworkStores()
        .AddDefaultTokenProviders()
        .AddDefaultUI();

        services.AddTransient();
        services.Configure(Configuration);

        services.AddControllers(options => options.SuppressImplicitRequiredAttributeForNonNullableReferenceTypes = true);

        services.ConfigureApplicationCookie(options =>
        {
            // Cookie settings
            options.Cookie.HttpOnly = true;
            options.ExpireTimeSpan = TimeSpan.FromHours(24);

            options.LoginPath = "/Identity/Account/Login";
            options.AccessDeniedPath = "/Identity/Account/AccessDenied";
            options.SlidingExpiration = true;
        });

        services.AddControllersWithViews().AddJsonOptions(options => options.JsonSerializerOptions.PropertyNamingPolicy = null);
        services.AddRazorPages();
}

My Configure method in startup:

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/Home/Error");
            // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
            app.UseHsts();
        }

        //app.UseHttpsRedirection();
        app.UseStaticFiles();
        app.UseRouting();
        app.UseAuthentication();
        app.UseAuthorization();

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllerRoute(
                name: "default",
                pattern: "{controller=Home}/{action=Index}/{id?}");
            endpoints.MapRazorPages();
        });
}

Also, this "weird behavior" only happens while I am testing from the internet, which does not happen while I am debugging locally (localhost).

I will appreciate any help to discover the solution.

ASP.NET Core [Authorize] asking to log in page a recent logged in USER

0 Answers