How can I deny anonymous users from directly calling action methods? - asp.net-mvc

Question

I'm busting my head against the wall here. Please help.
I've developed an MVC 4.0 web application.
I am using the Facebook SDK to log in to the website.
For argument sake, I have 2 action methods: Index and Info.
Index is where the user clicks the "Log in using Facebook" button, and after he enters his credentials, he is supposed to be redirected to Info action method. (from there he can log out).
This is the Index method:
[AllowAnonymous]
public ActionResult Index()
{
return View();
}
I have this in my web.config:
<authentication mode="Forms">
<forms loginUrl="~/Home/Index" timeout="2880" />
</authentication>
These are the settings I entered at Facebook developers for my app:
Canvas URL:
http://localhost/[AppName]/
Secure Canvas URL:
https://localhost/[AppName]/
Site URL:
http://localhost/[AppName]/
Valid OAuth redirect URIs:
http://localhost/
and also
http://localhost/[AppName]/home/index
The problem is:
I want to make the Info action method only available to authorized users, so naturally, I decorated it with [Authorized] attribute:
[Authorize]
public ActionResult Info()
{
var client = new FacebookClient();
var oauthResult = client.ParseOAuthCallbackUrl(Request.Url);
// Build the Return URI form the Request Url
var redirectUri = new UriBuilder(Request.Url);
redirectUri.Path = Url.Action("Info", "Home");
// Exchange the code for an access token
dynamic result = client.Get("/oauth/access_token",
new { client_id = AppId,
redirect_uri = redirectUri.Uri.AbsoluteUri,
client_secret = SecId,
code = oauthResult.Code });
// Read the auth values
string accessToken = result.access_token;
Session["access_token"] = accessToken;
DateTime expires = DateTime.UtcNow.AddSeconds(Convert.ToDouble(result.expires));
// Get the user's profile information
dynamic me = client.Get("/me",
new
{
fields = "first_name,last_name,email,picture",
access_token = accessToken
});
var userInfo = new InfoModel()
{
firstName = me.first_name,
lastName = me.last_name,
emailId = me.email,
picture = me.picture,
accessToken = result.access_token
};
return View("Info", userInfo);
}
So now I have two unwated scenraios: I can either log in to my app, BUT after log in, i'm redirected to Home/Index, instead to Home/Info.
OR
I can log in properly (I am redirected to Home/Info after log in, as expected) BUT I can also browse directly to Info action method (since I had to remove the [Authorize] attribute in order to log in.
It's like a Rubik's Cube!
I'm sorry the post is long, but I had to elaborate.

Answer 1

I found and answer.
It's involve a little bit of a work-around, but it's as good:
[AllowAnonymous]
public ActionResult Info()
{
if (Request.Url.AbsoluteUri.Contains("Home/Info?code"))
{
var client = new FacebookClient();
var oauthResult = client.ParseOAuthCallbackUrl(Request.Url);
// Build the Return URI form the Request Url
var redirectUri = new UriBuilder(Request.Url);
redirectUri.Path = Url.Action("Info", "Home");
// Exchange the code for an access token
dynamic result = client.Get("/oauth/access_token",
new
{
client_id = AppId,
redirect_uri = redirectUri.Uri.AbsoluteUri,
client_secret = SecId,
code = oauthResult.Code
});
// Read the auth values
string accessToken = result.access_token;
Session["access_token"] = accessToken;
DateTime expires = DateTime.UtcNow.AddSeconds(Convert.ToDouble(result.expires));
// Get the user's profile information
dynamic me = client.Get("/me",
new
{
fields = "first_name,last_name,email,picture",
access_token = accessToken
});
var userInfo = new InfoModel()
{
firstName = me.first_name,
lastName = me.last_name,
emailId = me.email,
picture = me.picture,
accessToken = result.access_token
};
FormsAuthentication.SetAuthCookie(userInfo.emailId, true);
return View("Info", userInfo);
}
else
return View("Index");
}
As you can see, I had a condition at the beginning of the Action method:
If, and only if the url contains the word "code" then the user can authenticate, otherwise, he is redirected back to the first page.
If the word "code" exists, it means that the user has a token and therefore he has already entered his credentials correctly, so now his details can be extracted.
At the end of the extraction process, just before the redirection to the view, I added:
FormsAuthentication.SetAuthCookie(userInfo.emailId, true);
In order to save the cookie. This is what required for the [Authorize] attribute to function correctly, otherwise the code will act as though you are not authenticated, even though you are.
Now I can safely add an [Authorize] attribute to all the action methods I wish to make available to authenticated users only.
Don't forget to add [AllowAnonymous] attribute to every action method that are used as part of the authentication process, otherwise the user won't be able to browse their respective views.
BTW,
If the user tries to type he will get an error, since he still needs the token.