Question

I’m securing an ASP.NET MVC 2 application, and I have a user who is in the role “Foo”.

This is true:

User.IsInRole("Foo")

But yet, when I attempt to lock down a controller action like the following, the user is denied:

[Authorize(Roles = "Foo")]
public ActionResult PrivatePage()
{
    return View();
}

If IsInRole reports true, why would the Authorize attribute not allow the user in?

Answer 1

It could be caused if you are storing persistent cookies for your forms authentication cookie. In that scenario IsInRole may check against the cookie without verifying up to date login.