Question

I have a really weird scenario that I’m stuck on. I have a ASP.Net MVC 4 app where I’m authenticating a user and creating an authCookie and adding it to the response’s cookies then redirecting them to the target page:

            if (ModelState.IsValid)
            {
                var userAuthenticated = UserInfo.AuthenticateUser(model.UserName, model.Password);

                if (userAuthenticated)
                {
                    var userInfo = UserInfo.FindByUserName(model.UserName);

                    //SERIALIZE AUTHENTICATED USER
                    var serializer = new JavaScriptSerializer();
                    var serializedUser = serializer.Serialize(userInfo);
                    var ticket = new FormsAuthenticationTicket(1, model.UserName, DateTime.Now, DateTime.Now.AddMinutes(30), false, serializedUser);
                    var hash = FormsAuthentication.Encrypt(ticket);
                    var authCookie = new HttpCookie(FormsAuthentication.FormsCookieName, hash) {Expires = ticket.Expiration};

                    Response.Cookies.Add(authCookie);

                    if (Url.IsLocalUrl(model.ReturnUrl) && model.ReturnUrl.Length > 1 && model.ReturnUrl.StartsWith("/") && !model.ReturnUrl.StartsWith("//") && !model.ReturnUrl.StartsWith("/\\"))
                    {
                        return Redirect(model.ReturnUrl);
                    }

                    var url = Url.Action("Index", "Course");
                    return Redirect(url);
                }

                ModelState.AddModelError("", "The user name or password provided is incorrect.");
            }

This is working just fine in all browsers. I can login and access the secure pages in my app.

My client is requesting an android version of this app. So, I’m trying to figure out how to convert this app into an APK file. My first attempt is to create a simple index.html page with an iframe that targets the application. This works just fine in Firefox and IE 9. However, when accessing the index.html page that contains the iframe that points to the app via Chrome, I get past the login code above and the user gets redirected to the secure controller, but the secure controller has a custom attribute to make sure the user is authenticated:

public class RequiresAuthenticationAttribute : ActionFilterAttribute
    {
        public override void OnActionExecuting(ActionExecutingContext filterContext)
        {
            if (filterContext.HttpContext.User.Identity.IsAuthenticated) return;
            if (filterContext.HttpContext.Request.Url == null) return;

            var returnUrl = filterContext.HttpContext.Request.Url.AbsolutePath;

            if (!filterContext.HttpContext.Request.Browser.IsMobileDevice)
            {
                filterContext.HttpContext.Response.Redirect(FormsAuthentication.LoginUrl + string.Format("?ReturnUrl={0}", returnUrl), true);
            }
            else
            {
                filterContext.HttpContext.Response.Redirect("/Home/Home", true);
            }           
        }
    }

My app is failing on: filterContext.HttpContext.User.Identity.IsAuthenticated. IsAuthenticated is always false, even though the user was authenticated in the code above.

Keep in mind this only happens when accessing the app via iframe in Chrome. If I access the app directly instead of via iframe, then everything works just fine.

Any ideas?

UPDATE:

My controller extends SecureController. In the constructor of SecureController I have the code that deserializes the user:

public SecureController()
        {
            var context = new HttpContextWrapper(System.Web.HttpContext.Current);

            if (context.Request.Cookies[FormsAuthentication.FormsCookieName] != null)
            {
                var serializer = new JavaScriptSerializer();
                var cookie = context.Request.Cookies[FormsAuthentication.FormsCookieName].Value;
                var ticket = FormsAuthentication.Decrypt(cookie);
                CurrentUser = serializer.Deserialize<UserInfo>(ticket.UserData);
            }
            else
            {
                CurrentUser = new UserInfo();
            }


            //if ajax request and session has expired, then force re-login
            if (context.Request.IsAjaxRequest() && context.Request.IsAuthenticated == false)
            {
                context.Response.Clear();
                context.Response.StatusCode = 401;
                context.Response.Flush();
            }
        }

Answer 1

First, you should be deriving from AuthorizeAttribute, not an ActionFilterAttribute. Authorization attributes execute before the method is even called at a higher level of the pipeline, while ActionFilters execute much further down, and other attributes can execute before yours.

Secondly, you aren’t showing the code you use to decrypt the ticket and set the IPrincipal and IIdentity. Since that’s where the problem is, it’s odd that you didn’t include it.