Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Ok, answering my own questin.</p> <p>After looking into this issue and researching a bit more I found that when a web-app is protected by Forms-Authentication and the user is <strong>not authenticated</strong>, this is what happens:</p> <ul> <li>If it's a GET-request - the user is redirected to the login page.</li> <li>If it's a POST-request to a page - the user is redirected to the login page.</li> <li>If it's a POST-request <strong>to a web-service</strong> - the user gets 401-unauthorized</li> </ul> <p>Thats how ASP.NET works</p> <p>And if a web-service is called by AJAX (xmlHttpRequest object) and returns 401 - of course the browser shows a pop-up login box.</p> <p>Now, what should you do is add some code to Application_PostAuthenticateRequest that will prevent throwing 401 for webservices.</p> <pre><code>protected void Application_PostAuthenticateRequest(Object sender, EventArgs e) { if (Request.RequestType == "POST" //if its POST &amp;&amp; !User.Identity.IsAuthenticated //if user NOT authed &amp;&amp; !HasAnonymousAccess(Context) //if it's not the login page ) { //lets get the auth type Configuration config = WebConfigurationManager.OpenWebConfiguration("~"); SystemWebSectionGroup grp = (SystemWebSectionGroup)config.GetSectionGroup("system.web"); AuthenticationSection auth = grp.Authentication; //if it FORMS auth if(auth.Mode== AuthenticationMode.Forms) { //then redirect... this redirect won't work for AJAX cause xmlHttpRequest can't handle redirects, but anyway... Response.Redirect(FormsAuthentication.LoginUrl, true); Response.End(); } } } public static bool HasAnonymousAccess(HttpContext context) { return UrlAuthorizationModule.CheckUrlAccessForPrincipal( context.Request.Path, new GenericPrincipal(new GenericIdentity(string.Empty), null), context.Request.HttpMethod); } </code></pre>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload