MVC - Enabling Forms Authentication - asp.net-mvc

I have MVC 1.0 app with VS2008.
I have added configuration to web.config but the app crashes
in the Default.aspx page code behind. Dont know why its loading that page.
I am just uing all the default setup for MVC 1.0.
This is my webconfig. Shouldn't it show my login page with this config????
Malcolm
<?xml version="1.0"?>
<configuration>
<system.web>
<httpHandlers>
<add path="*" verb="*"
type="System.Web.HttpNotFoundHandler"/>
</httpHandlers>
<!--
Enabling request validation in view pages would cause validation to occur
after the input has already been processed by the controller. By default
MVC performs request validation before a controller processes the input.
To change this behavior apply the ValidateInputAttribute to a
controller or action.
-->
<identity impersonate="false"/>
<pages
validateRequest="false"
pageParserFilterType="System.Web.Mvc.ViewTypeParserFilter, System.Web.Mvc, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"
pageBaseType="System.Web.Mvc.ViewPage, System.Web.Mvc, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"
userControlBaseType="System.Web.Mvc.ViewUserControl, System.Web.Mvc, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35">
<controls>
<add assembly="System.Web.Mvc, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" namespace="System.Web.Mvc" tagPrefix="mvc" />
</controls>
</pages>
<authentication mode="Forms">
<forms loginUrl="/Account/LogOn" defaultUrl="/Home/Index"></forms>
</authentication>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
<location path="Content/Site.css">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
<system.webServer>
<validation validateIntegratedModeConfiguration="false"/>
<handlers>
<remove name="BlockViewHandler"/>
<add name="BlockViewHandler" path="*" verb="*" preCondition="integratedMode" type="System.Web.HttpNotFoundHandler"/>
</handlers>
</system.webServer>
</configuration>

The default template project in ASP.NET MVC does have support for User Accounts, including Forms Authentication, creating users etc. Take a look at the template project and copy/get inspiration from their configuration file and AccountController.

Related

How to call .cshtml file directly with .cshtml extension from browser without using MVC

I'm getting the below error when i used to call the .cshtml page in IIS 8
Server Error in '/' Application.
This type of page is not served.
Description: The type of page you have requested is not served because it has been explicitly forbidden. The extension '.cshtml' may be incorrect. Please review the URL below and make sure that it is spelled correctly.
Requested URL: /_header.cshtml
To serve CSHTML files to direct browser requests, you need set following appsetting in web.config to true. By default this value is set to false in web.config.
<add key="webpages:Enabled" value="true" />
For more informat about this setting, Read this resource.
Web.config inside my Views Folder is -
<configuration>
<!--<configSections>
<sectionGroup name="system.web.webPages.razor" type="System.Web.WebPages.Razor.Configuration.RazorWebSectionGroup, System.Web.WebPages.Razor, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35">
<section name="host" type="System.Web.WebPages.Razor.Configuration.HostSection, System.Web.WebPages.Razor, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" />
<section name="pages" type="System.Web.WebPages.Razor.Configuration.RazorPagesSection, System.Web.WebPages.Razor, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" />
</sectionGroup>
</configSections>-->
<!--<system.web.webPages.razor>
<host factoryType="System.Web.Mvc.MvcWebRazorHostFactory, System.Web.Mvc, Version=5.2.2.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
<pages pageBaseType="System.Web.Mvc.WebViewPage">
<namespaces>
<add namespace="System.Web.Mvc" />
<add namespace="System.Web.Mvc.Ajax" />
<add namespace="System.Web.Mvc.Html" />
<add namespace="System.Web.Optimization"/>
<add namespace="System.Web.Routing" />
<add namespace="WebApplication1" />
</namespaces>
</pages>
</system.web.webPages.razor>-->
<appSettings>
<add key="webpages:Enabled" value="true" />
</appSettings>
<system.webServer>
<handlers>
<!--<remove name="BlockViewHandler"/>
<add name="BlockViewHandler" path="*" verb="*" preCondition="integratedMode" type="System.Web.HttpNotFoundHandler" />-->
</handlers>
</system.webServer>
</configuration>
With this config, I was able to get the CSHTML hit the browser and contents get displayed.
I wouldn't suggest you to do the above settings as by passing RAZOR view Engine for views is not advisable. Instead put all the static files in a folder and add those exceptions to the http pipeline.
To use a cshtml page without MVC you have to use what Microsoft calls "ASP.NET Web Pages." It is another technology inside ASP.NET like Web Forms and MVC. You should be able to enable it by adding this to your web.config.
<appSettings>
<add key="webpages:Enabled" value="true" />
</appSettings>
In the Views folder of your application you will find a web.config. In that web.config you will find the following entry.
<add name="BlockViewHandler" path="*" verb="*" preCondition="integratedMode" type="System.Web.HttpNotFoundHandler" />
Basically that entry says that no matter what HTTP verb someone uses it should refuse to return anything that is in the Views folder or a subfolder.
You could remove that entry, but that means someone could request your raw views which could be potentially dangerous.
If you don't want to run the view through Razor then you should create a plain HTML file. You can either put that HTML file in a different folder in your application or you can change the BlockViewHandler to be more specific.
<add name="BlockViewHandler" path="*.cshtml" verb="*" preCondition="integratedMode" type="System.Web.HttpNotFoundHandler" />

RememberMe and RememberBrowser not working when browser is closed

I am using asp net mvc 5 + Identity 2.0 + Owin + IdentityReboot project on my website. For login, I am using a two-factor login with email code confirmation as second login pass. Everything looks fine, except for the fact that the rememberMe functionality and the rememberBrowser are not working when I close the browser. It looks like the cookies created are not persistent. Here is my full web.config
<?xml version="1.0"?>
<configuration>
<configSections>
<sectionGroup name="system.web.webPages.razor" type="System.Web.WebPages.Razor.Configuration.RazorWebSectionGroup, System.Web.WebPages.Razor, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35">
<section name="host" type="System.Web.WebPages.Razor.Configuration.HostSection, System.Web.WebPages.Razor, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" />
<section name="pages" type="System.Web.WebPages.Razor.Configuration.RazorPagesSection, System.Web.WebPages.Razor, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" />
</sectionGroup>
</configSections>
<system.web.webPages.razor>
<host factoryType="System.Web.Mvc.MvcWebRazorHostFactory, System.Web.Mvc, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
<pages pageBaseType="System.Web.Mvc.WebViewPage">
<namespaces>
<add namespace="System.Web.Mvc" />
<add namespace="System.Web.Mvc.Ajax" />
<add namespace="System.Web.Mvc.Html" />
<add namespace="System.Web.Optimization"/>
<add namespace="System.Web.Routing" />
</namespaces>
</pages>
</system.web.webPages.razor>
<appSettings>
<add key="webpages:Enabled" value="false" />
</appSettings>
<system.web>
<httpHandlers>
<add path="*" verb="*" type="System.Web.HttpNotFoundHandler"/>
</httpHandlers>
<!--
Enabling request validation in view pages would cause validation to occur
after the input has already been processed by the controller. By default
MVC performs request validation before a controller processes the input.
To change this behavior apply the ValidateInputAttribute to a
controller or action.
-->
<pages
validateRequest="false"
pageParserFilterType="System.Web.Mvc.ViewTypeParserFilter, System.Web.Mvc, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"
pageBaseType="System.Web.Mvc.ViewPage, System.Web.Mvc, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"
userControlBaseType="System.Web.Mvc.ViewUserControl, System.Web.Mvc, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35">
<controls>
<add assembly="System.Web.Mvc, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" namespace="System.Web.Mvc" tagPrefix="mvc" />
</controls>
</pages>
</system.web>
<system.webServer>
<validation validateIntegratedModeConfiguration="false" />
<handlers>
<remove name="BlockViewHandler"/>
<add name="BlockViewHandler" path="*" verb="*" preCondition="integratedMode" type="System.Web.HttpNotFoundHandler" />
</handlers>
</system.webServer>
</configuration>
Can anyone give me an advice here?
Possibly some confusion on rememberBrowser. If you enable 2FA and don't rememberBrowser, then you will need to go through 2FA to log on. If you enable 2FA and rememberBrowser, it won't go through 2FA on that computer/browser combo.
Can you test this out with the latest sample?
Follow my tutorial and use Install-Package Microsoft.AspNet.Identity.Samples -Version 2.1.0-alpha1 –Pre
The idea behind this is on your home/trusted computer, you don't want to go through 2FA each time, but every other place you log in you want to make sure it's not the bad guy.

Form data lost during the authentication process-- but only in integrated pipeline mode

I maintain an ASP.NET MVC application (version 1) that currently runs on IIS 7 in classic mode. We'd like to start running the app in integrated pipeline mode instead. However, I am running into a bizarre problem that is preventing us from switching to integrated mode-- when we try, the application stops receiving forms data. (I.e. data send via the POST method.)
By adding a ton of logging to the Global.aspx file, I was able to narrow down the location where the forms data is getting lost. Here's what seems to be happening.
Upon receiving the request, the Application_BeginRequest event is fired. At this point, the forms data is present and can be seen by examining the request object's Forms or Params property. The request's Url property at this point does not have an ".mvc" extension anywhere in it. (More on this below.)
Next, the Application_AuthenticateRequest event is fired. Again, the forms data is present, and the URL has no ".mvc" extension.
At this point, what I would expect to happen is for the Application_PostAuthenticateRequest event to fire. But what acutally happens is that Application_BeginRequest is called again. This time, the forms data is gone-- it's not in Forms, Params, or anywhere else. In addition, the URL has changed so that the controller name part of the Url has an ".mvc" extension tacked onto it. For instance, if the URL in steps 1 and 2 is "/Education/Manage", then in step 3 it shows up as "/Education.mvc/Manage".
The Application_AuthenticateRequest event is fired again. Again, the forms data is missing, and the URL has an ".mvc" extension embedded in it.
This time, Application_PostAuthenticateRequest is fired, and the rest of the page's life cycle proceeds normally. In this and all subsequent events, there's no forms data, and the ".mvc" extension remains present.
The problem only occurs when I switch to the integrated pipeline mode. It works fine in classic mode. I've been googling for days, and unfortunately I've been unable to find any reference to a similar problem. I've also tried editing the Web.config file in several different ways hoping to solve the problem, without any luck. I'm hoping somebody here can shed some light on the issue.
Here are a few relevant code snippets. If there's any other code I should include, please let me know.
From Web.config:
<system.web>
<authentication mode="Forms">
<forms name=".appLive" timeout="60" enableCrossAppRedirects="true" path="/" />
</authentication>
[...]
</system.web>
[....]
<system.webServer>
<modules runAllManagedModulesForAllRequests="true">
<remove name="ScriptModule" />
<remove name="UrlRoutingModule" />
<add name="ScriptModule" preCondition="managedHandler" type="System.Web.Handlers.ScriptModule, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
<add name="UrlRoutingModule" type="System.Web.Routing.UrlRoutingModule, System.Web.Routing, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
<remove name="FormsAuthenticationModule" />
<remove name="UrlAuthorization" />
<remove name="DefaultAuthentication" />
<add name="DefaultAuthentication" type="System.Web.Security.DefaultAuthenticationModule" />
</modules>
<handlers>
<remove name="AboMapperCustom-17403419" />
<remove name="WebServiceHandlerFactory-Integrated" />
<remove name="ScriptHandlerFactory" />
<remove name="ScriptHandlerFactoryAppServices" />
<remove name="ScriptResource" />
<add name="ScriptHandlerFactory" verb="*" path="*.asmx" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
<add name="ScriptHandlerFactoryAppServices" verb="*" path="*_AppService.axd" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
<add name="ScriptResource" preCondition="integratedMode" verb="GET,HEAD" path="ScriptResource.axd" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
<add name="MvcHttpHandler" preCondition="integratedMode" verb="*" path="*.mvc" type="System.Web.Mvc.MvcHttpHandler, System.Web.Mvc, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
<add name="UrlRoutingHandler" preCondition="integratedMode" verb="*" path="UrlRouting.axd" type="System.Web.HttpForbiddenHandler, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
<add name="AboMapperCustom-17403419" path="*.mvc" verb="GET,POST,HEAD,DEBUG" modules="IsapiModule" scriptProcessor="C:\Windows\microsoft.net\framework\v2.0.50727\aspnet_isapi.dll" resourceType="Unspecified" requireAccess="Script" preCondition="classicMode,bitness32,runtimeVersionv2.0" responseBufferLimit="0" />
</handlers>
</system.webServer>
From Global.aspx:
public void Application_BeginRequest(Object source, EventArgs e)
{
HttpApplication application = source as HttpApplication;
if (source != null)
{
if (application.Request.AppRelativeCurrentExecutionFilePath.Contains(".mvc"))
{
application.Context.RewritePath(application.Request.Url.PathAndQuery.Replace(".mvc", string.Empty));
}
}
}
Are you by any chance using a URL rewriter or wildcard mapping to support classic mode? You don't need this for integrated mode and should turn it off.

Deploy ASP.NET MVC 2 applicatiopn to Windows 2008 R2

I have a ASP.Net MVC 2 web site, which can be visited by http://localhost/Admin/ContentMgr/ in ASP.Net Development Server from Visual Studio 2010(RTM Retail).
When I try to deploy the site to Windows 2008 R2 , IIS 7.5 , the url always return 404.
First, my application pool is running on .Net 4.0, and Integration mode.
Second, my IIS do have "HTTP ERROR" and "HTTP Redirection" features on
And this is my web.config.
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.web>
<compilation debug="true" defaultLanguage="c#" targetFramework="4.0">
<assemblies>
<add assembly="System.Web.Abstractions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
<add assembly="System.Web.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
<add assembly="System.Web.Mvc, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
</assemblies>
</compilation>
<!--
<authentication mode="Forms">
<forms loginUrl="~/Account/LogOn" timeout="2880" />
</authentication>
-->
<pages>
<namespaces>
<add namespace="System.Web.Mvc" />
<add namespace="System.Web.Mvc.Ajax" />
<add namespace="System.Web.Mvc.Html" />
<add namespace="System.Web.Routing" />
</namespaces>
</pages>
</system.web>
<system.webServer>
<validation validateIntegratedModeConfiguration="false" />
<modules runAllManagedModulesForAllRequests="true" >
<remove name="UrlRoutingModule"/>
<add name="UrlRoutingModule" type="System.Web.Routing.UrlRoutingModule, System.Web.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
</modules>
<handlers>
<remove name="MvcHttpHandler" />
<add name="MvcHttpHandler" preCondition="integratedMode" verb="*" path="*.mvc" type="System.Web.Mvc.MvcHttpHandler" />
<add name="UrlRoutingHandler" preCondition="integratedMode" verb="*" path="UrlRouting.axd" type="System.Web.HttpForbiddenHandler, System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
</handlers>
<httpErrors errorMode="Detailed" />
</system.webServer>
<runtime>
<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
<dependentAssembly>
<assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" />
<bindingRedirect oldVersion="1.0.0.0" newVersion="2.0.0.0" />
</dependentAssembly>
</assemblyBinding>
</runtime>
</configuration>
ASP.net MVC 2 is not included in .net 4. You have two options:
Deploy the System.Web.Mvc.dll file into the /bin folder of your app
Install ASP.net MVC 2 in the server following this cryptic procedure

Why is my MVC site asking for logon?

I have created a ASP.NET MVC app and changed from the dev server to the local IIS
server by clicking on Create Virtual Directory and also changing managed pipeline mode
to integrated.
But now when I run the app it shows the logon page.
Why, this is my web.config???
<?xml version="1.0"?>
<configuration>
<system.web>
<httpHandlers>
<add path="*" verb="*"
type="System.Web.HttpNotFoundHandler"/>
</httpHandlers>
<!--
Enabling request validation in view pages would cause validation to occur
after the input has already been processed by the controller. By default
MVC performs request validation before a controller processes the input.
To change this behavior apply the ValidateInputAttribute to a
controller or action.
-->
<pages
validateRequest="false"
pageParserFilterType="System.Web.Mvc.ViewTypeParserFilter, System.Web.Mvc, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"
pageBaseType="System.Web.Mvc.ViewPage, System.Web.Mvc, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"
userControlBaseType="System.Web.Mvc.ViewUserControl, System.Web.Mvc, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35">
<controls>
<add assembly="System.Web.Mvc, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" namespace="System.Web.Mvc" tagPrefix="mvc" />
</controls>
</pages>
</system.web>
<system.webServer>
<validation validateIntegratedModeConfiguration="false"/>
<handlers>
<remove name="BlockViewHandler"/>
<add name="BlockViewHandler" path="*" verb="*" preCondition="integratedMode" type="System.Web.HttpNotFoundHandler"/>
</handlers>
</system.webServer>
</configuration>
That looks like the Web.Config inside the Views folder. You should check the one in the root of your site.

Resources