Question

I use an <Authorize> attribute in ASP.NET MVC to secure a controller. My page loads portions of its content via AJAX. Here’s a problem I have with IE8, but not Firefox 3.6:

1. Sign in as user JohnDoe and navigate to http://www.example.com/AjaxPage. Everything works fine. AjaxPage is protected with the <Authorize> attribute.
2. Sign out, which redirects me to http://www.example.com. That page doesn’t use <Authorize>.
3. Navigate to http://www.example.com/AjaxPage without signing in again. I should be redirected to the Sign In page since that controller has the <Authorize> attribute.

Step 3 works with Firefox, but IE8 displays the non-Ajax portion of http://www.example.com/AjaxPage and then never loads the Ajax content. I’m surprised any content is displayed at all since I should be redirected to the Sign In page.

My code redirects to the login page with:

Return Redirect("https://login.live.com/wlogin.srf?appid=MY-APP-ID&alg=wsignin1.0")

Why does Firefox handle this redirection, but IE doesn’t? Since it works the first time (Step 1 above), is there a cache issue?

EDIT: I used Fiddler to see if AjaxPage was being cached, but it appears not to be. I assume if it were cached, I’d get an HTTP Status Code 200 back. I may simply misunderstand this though.

Answer 1

[OutputCache(NoStore = true, Duration = 0, VaryByParam = "*")]

This attribute, placed in controller class, disables caching. Since I don’t need caching in my application, I placed it in my BaseController class:

[OutputCache(NoStore = true, Duration = 0, VaryByParam = "*")]
public abstract class BaseController : Controller
{

Here is nice description about OutputCacheAttribute: Improving Performance with Output Caching