Updating IsAuthenticated in action doesn't apply to subsequent action? - asp.net-mvc-4

Question

I got this action:
public ActionResult Index(string username, int userID)
{
if (!HttpContext.User.Identity.IsAuthenticated)
{
var ticket = new FormsAuthenticationTicket(2, username, DateTime.Now, DateTime.Now.AddDays(7), false, string.Empty);
var encr = FormsAuthentication.Encrypt(ticket);
var cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encr);
Response.Cookies.Add(cookie);
}
return View("Index",null,username);
}
Later, this partial view action is invoked:
public PartialViewResult PageHeader()
{
if (HttpContext.User.Identity.IsAuthenticated)
{
string username = HttpContext.User.Identity.Name;
...
}
}
The expression HttpContext.User.Identity.IsAuthenticated is evaluated to false even though the auth cookie was set in the previous action. Only after refreshing the page does the expression evaluate to true.
So my question is: How do I tell asp.net mvc that user is already authenticated, and use HttpContext.User.Identity property?

Answer 1

This seems like an odd approach; you're performing authentication in the wrong layer.
The user is typically authenticated before they get to the action method (being called). This way you can prevent them from entering the controller or action if they are not authenticated.
Why not use the framework to take care of this task? It will automatically set the cookie for you in the correct context at the correct stage in the pipeline.
Subclass MembershipProvider and Override ValidateUser(string username, string password):
In this method, do your verification with username and password. If validation fails (wrong username/password, etc), return false. If it succeeds, return true, and the auth cookie will be set for you.
From this point, you can create Authorization Attributes (by subclassing AuthorizationAttribute) and decorate your controllers or actions. In these attributes, you can do things like check user roles, scopes, permissions, etc and reject the request if the user is not properly authorized to make the request. It's super simple.
You will need to do 3 things:
Create a custom MembershipProvider which validates the user (username/password check),
Create custom AuthorizeAttribute which checks the user's authenticated/authorized status. It could be as simple as verifying that they have been authenticated (just return User.Identity.IsAuthenticated. If it's false, it will send them to the login screen. Otherwise , it'll allow them to continue with the request), and add the Custom provider to the web.config so it knows to use it. You may also have to set the Login page in web.config if you haven't already done that.
This is the right(er) way to do it and will likely solve your problem while also cleaning up your project.
// The provider
// This is what gets called during login. your logic to validate the user is placed here
// Return true or false which will indicate whether or not an auth token/cookie will be set
public class MyCustomProvider : MembershipProvider
{
public override bool ValidateUser(string username, string password)
{
const string testUsername = "User1";
const string testPassword = "abcd1234";
// do whatever you need to do in order to verify this dude's identity
return username.Equals(testUsername) && password.Equals(testPassword);
}
//... bunch of other overrides. I only implement them if I actually use them otherwise just wrap them in a region and hide them.
}
// The web.config update. Tell the framework where your login page is. Typically, in an MVC project,
// The view is in Views/Account and the action Login on the Account controller calls WebSecurity.Login
// which is what runs your provider. Define both here.
<system.web>
<authentication mode="Forms">
<forms loginUrl="~/Account/Login" />
</authentication>
<membership defaultProvider="MyCustomProvider">
<providers>
<remove name="AspNetSqlProvider" />
<add name="MyCustomProvider"
type="FullyQualifiedName.MyCustomProvider, AuthDemo, Version=1.0.0.0, Culture=neutral" />
</providers>
</membership>
<compilation debug="true" targetFramework="4.5" />
<httpRuntime targetFramework="4.5" />
</system.web>
// The authorize attribute
// This is where you can check your user's authorization. In this example, I just
// check to see that he was authenticated by the provider.
public class MyCustomAuthorizeAttribute : AuthorizeAttribute
{
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
// do whatever you need to do here to verify that this dude is allowed to be here
return httpContext.User.Identity.IsAuthenticated;
}
}
// sample usage of the attribute
// the framework will run this attribute before it allows the user into the controller.
// You could also do this at the action level instead of the controller level
[MyCustomAuthorize]
public class HomeController : Controller
{
public ActionResult Index()
{
return View();
}
public ActionResult About()
{
ViewBag.Message = "Your application description page.";
return View();
}
public ActionResult Contact()
{
ViewBag.Message = "Your contact page.";
return View();
}
}

Answer 2

ASP.NET only sets once the HttpContext.User.Identity.IsAuthenticated at a beginning of the request.
So setting later the authentication cookie inside a controller action does not have any effect on the HttpContext.User.Identity.IsAuthenticated because you are in the context of the same request.
The suggested "workflow" for the forms authentication is the following:
Client sends username and password to the server
The server validates the credentials and set the authentication cookie
Client client sends the authentication cookie on subsequent requests
So you need issue a new request in order to the HttpContext.User.Identity.IsAuthenticated gets updated correctly.
The standard practice on successful login is to redirect to client to the original url where it came from or in your case just redirect it to the same action:
public ActionResult Index(string username, int userID)
{
if (!HttpContext.User.Identity.IsAuthenticated)
{
var ticket = new FormsAuthenticationTicket(2, username, DateTime.Now,
DateTime.Now.AddDays(7), false, string.Empty);
var encr = FormsAuthentication.Encrypt(ticket);
var cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encr);
Response.Cookies.Add(cookie);
return RedirectToAction("Index", new {username, userID});
}
return View("Index", null, username);
}