I'm developing a mobile application using MVC 4. And I'm securing it. The application has 2 pages ("home" and "Clientes")
When the application starts it asks me for a username and password, with this being its URL http://localhost:59170/Account/Login?ReturnUrl=%2f.
I login and go to the home page. This is the url I can see on IE http://localhost:59170/Account/Login?ReturnUrl=%2f.
From this page I go to the Clientes page. This is the url that I can see on IE http://localhost:59170/Account/Login?ReturnUrl=%2f#/Clientes. At the moment all works ok (Though url like something stranger).
The problem occurs when I press the back button on IE. It must go to the home page but I go to http://localhost:59170/Account/Login?ReturnUrl=%2f#/Account/Login?ReturnUrl=%2f where it asks me to login.
What might cause this behaviour and how do I solve it?
Each time you request a page that requires authentication, .NET will redirect you to your designated login page and append the requested URL to the URL. That way, once the user has logged in successfully it will redirect them to the page they requested automatically. In your first URL for example the return URL encoded representation of / i.e. the root/ homepage of your site
It will keep redirecting you until you have authenticated. If you don't want to have authentication on your homepage then just annotate your account controller with [Authorize] and not your home controller
Related
I have an ASP.NET MVC application with a number of pages.
I'm trying to authenticate the user before opening a page.
I have created a Login page that works and authorizing a user.
However, when I enter the page URL directly in the browser, I'm able to open it.
How can I restrict the user from opening the page directly?
I have a page with public access, role based authentication, on it. Now when I surf to this page I see my login page, but the url is still the one of the protected page.
Why is this? Can we change this so it redirects normal to the login page?
The built in behaviour of Umbraco is to keep the protected URL in the browser and then display the login page on it. As far as I know, you can't change this behaviour out of the box, but if it bothers you, you can add a check to your login view to check of the request URL matches the URL of the login node (it shouldn't do in in your case), and do a redirect to the actual login page if they're different.
I believe this is done so that it doesn't have to redirect you once you've logged in, as you're still on the URL that you originally requested.
I have page where are secured by session. In case session does exists, then navigate to login page. This works fine.
Now, Let's say I am at some page like abc.aspx. Session does not exists. System navigates to th login page. So, once login, can i navigate the user to the page which was originally requested ?
Usually it is performed by adding the requested URL as a query parameter to Login page URL http://fakehost/Login?retUrl=originalpage
so app code can redirect it back. Forms authentication mechanism does it for you.
yes you can however it would be recommended to add a ReturnUrl querystring which contains the page they came from or need to go to after they logged in. you can also use Request.UrlReferrer I believe which gives you the page they came from but means if for example they came from google to your site to login and you redirect, it would go back to google.
Integrating WIF into regular ASP.NET 4.0 website.
I have STS setup and when I navigate to my RP website, it redirects me to STS Login page.
What I want to do is I have Home.aspx in my RP. It is a public page open to everyone. It has have a Login link. When the I click that link it takes me to the STS login page and upon logout I get redirected to Home.aspx again.
Issue:
I have set in RP's web.config to allow access to everyone to Home.aspx and Set up as the startup page. I also have it setup as Default document. But when I navigate to my site, it takes me to STS Login page.
Why doesn't it take me to home.aspx?
If I manually modify the url to go to home.aspx, it is allowing me.
Any ideas?
Update:
Found this: http://social.msdn.microsoft.com/Forums/en-US/Geneva/thread/71806907-393f-4782-9c30-971be94a2b62/
But that's really a weird workaround.
The link shows how to unprotect a page i.e. a page that can be accessed without a redirect to ADFS.
You could simply put a link on that page that goes to the ADFS login page.
I'm using the Oauth redirect authorization method to provide authorization for a page tab iframe application.
The flow works like this:
User loads page tab (unauthorized)
User clicks authorize link
Authorization dialog takes over parent window
Accepted authorization redirects to my application to register user account using authorized email.
My application redirects back to the page tab
Loading the page tab causes authorization to be lost, and the user sees the authorize link again. Rinse, repeat, no success.
Confusingly, the application works completely if instead of redirecting to the Facebook Page Tab, I redirect to any path in my application (ie. the root, the user's page, etc.). Only by setting the redirect to the Facebook Page Tab URL does the user get "booted".
Even stranger, if I keep redirection limited to my application, but simply load the Facebook Page Tab, the authorization is killed everywhere. Meaning, post-facebook-page-load, refreshing the application off-Facebook will prompt the user to authorize again, and they are effectively "logged out" of my system.
I am using Rails 3.0.1 with Devise 1.4.2 for user accounts. The user authorization is passed to a Devise registration (I need to keep track of users in my app - a voting-based "contest" application). Devise uses the "Server side Flow" detailed here: http://developers.facebook.com/docs/authentication/
I'm lost as to what would be causing this. Facebook killing the auth cookie? Does this happen?
When you access the facebook tab page first time,signed_request is necessary:
#signed_request = oauth.parse_signed_request(params[:signed_request])
So you can send a parameter when redirect to it from other pages to check if it's the first time.