Undesired logout in MVC 4 - asp.net-mvc-4

Question

I have this issue after publish project in host, in development environment everything is OK!
In my published MVC 4.0 website when an authenticated user try to upload a picture, the user has been logged off and redirected to the Login Page.
I've used the following code to upload pictures and successfully work in local:
private void TryUploadImages(Product product)
{
const string emptyImage = "empty.jpg";
try
{
for (int idx = 0; idx < 3; idx++)
{
if ((Request.Files.Count < 3) ||
(Request.Files[idx] == null) ||
(Request.Files[idx].ContentLength > 1024 * 1024 * 5) ||
(Request.Files[idx].ContentLength <= 0))
{
if ((idx == 0 && string.IsNullOrEmpty(product.ImageFilename)) ||
(idx == 1 && string.IsNullOrEmpty(product.ThumbnailImage)) ||
(idx == 2 && string.IsNullOrEmpty(product.AttributesImage)))
throw new Exception(GlobalResources.Global_Image_Restrictions_Error);
continue;
}
HttpPostedFileBase uploadedFile = Request.Files[idx];
string fileName = Path.GetFileName(uploadedFile.FileName);
using (var img = Image.FromStream(uploadedFile.InputStream))
{ bool temp = img.Width > 0; }
if (!string.IsNullOrEmpty(fileName))
{
string[] filenames = {"product", "product-thumb", "attribute"};
fileName = string.Format("{0}-{1}{2}",
filenames[idx],
Guid.NewGuid().ToString().Replace("-", string.Empty),
Path.GetExtension(fileName));
var physicalPath = Path.Combine(Server.MapPath("~/Images/sitepx/products/"), fileName);
uploadedFile.SaveAs(physicalPath);
switch (idx)
{
case 0:
product.ImageFilename = fileName;
break;
case 1:
product.ThumbnailImage = fileName;
break;
case 2:
product.AttributesImage = fileName;
break;
}
}
else
{
switch (idx)
{
case 0:
product.ImageFilename = emptyImage;
break;
case 1:
product.ThumbnailImage = emptyImage;
break;
case 2:
product.AttributesImage = emptyImage;
break;
}
}
}
}
catch (Exception ex)
{
ViewBag.UploadError = ex.Message;
product.ImageFilename = emptyImage;
}
}
and call it in this action method:
[AllowUploadSafeFiles]
[AllowUploadSpecialFilesOnly(".jpg,.jpeg,.gif,.png,.bmp")]
[HttpPost]
public virtual ActionResult Edit(Product product)
{
if (ModelState.IsValid)
{
TryUploadImages(product);
product.ModifiedOn = DateTime.Now;
_db.Entry(product).State = EntityState.Modified;
_db.SaveChanges();
return RedirectToAction(MVC.Product.ActionNames.Index);
}
ViewBag.CategoryId = new SelectList(_db.Categories, "CategoryId", "Name", product.CategoryId);
ViewBag.ProductTypeId = new SelectList(_db.ProductTypes, "ProductTypeId", "Name", product.ProductTypeId);
return View(product);
}
Moreover I authorize controller for particular Roles and also disable Sessions in Web.config for security reasons :
<httpModules>
<-- blah blah blah ... -->
<!-- Disable Session -->
<remove name="Session" />
</httpModules>
<sessionState mode="Off" />
If you still need additional information, feel free to tell.
Thanks
===== EDITED (Add authentication detail) =====
Maybe I looking for trouble in the wrong place, my login method is something like this:
[AllowAnonymous]
public virtual ActionResult Login(string returnUrl)
{
if (User.Identity.IsAuthenticated)
if (!string.IsNullOrEmpty(returnUrl) && Url.IsLocalUrl(returnUrl))
return RedirectToLocal(returnUrl);
else
return Redirect(ReturnRedirectUrl(returnUrl));
ViewBag.ReturnUrl = returnUrl;
ViewBag.Roles = GetAllAccountRoles();
return View();
}
[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public virtual ActionResult Login(LoginModel model, string returnUrl)
{
if (ModelState.IsValid && WebSecurity.Login(model.UserName, model.Password, model.RememberMe))
{
var location = ReturnRedirectUrl(returnUrl);
return string.IsNullOrEmpty(location)
? RedirectToAction(MVC.Account.Login())
: RedirectToLocal(location);
}
// If we got this far, something failed, redisplay form
ModelState.AddModelError("", GlobalResources.Account_Login_ModelError);
return View(model);
}
and this is Role base ReturnRedirectUrl used in login function:
private string ReturnRedirectUrl(string returnUrl)
{
if (string.IsNullOrEmpty(returnUrl) || !Url.IsLocalUrl(returnUrl))
{
foreach (var role in Roles.GetAllRoles().Where(Roles.IsUserInRole))
{
switch (role)
{
case "info":
returnUrl = Url.Action(MVC.SiteManage.Index(1));
break;
case "support":
returnUrl = Url.Action(MVC.SiteManage.Index(2));
break;
case "sales":
returnUrl = Url.Action(MVC.SiteManage.Index(3));
break;
case "admin":
returnUrl = Url.Action(MVC.SiteManage.Index(6));
break;
case "club-member":
returnUrl = Url.Action(MVC.SiteManage.Index());
break;
case "vendor-reseller":
returnUrl = Url.Action(MVC.SiteManage.Index());
break;
case "sales-reseller":
returnUrl = Url.Action(MVC.SiteManage.Index());
break;
}
}
}
return returnUrl;
}