New Asp.Net MVC5 project produces an infinite loop to login page

Question

I am creating a brand new projet with Visual Studio 2013, I choose Asp.Net MVC and the framework 4.5.1 The project is created, then, I do nothing else than F5 to start the default web page. Unfortunately, it produces a redirect to the login page which is redirecting into the login page too. Here is a short version of the url I have in the browser:

http://localhost:5285/Account/Login?ReturnUrl=%2FAccount%2FLogin%3FReturnUrl%3D%252FAccount%252FLogin%253FReturnUrl%253D%25252FAccount%25252FLogin%25253FReturnUrl%25253D%2525252FAccount%2525252FLogin%2525253FReturnUrl%2525253D%252525252FAccount%252525252FLogin%252525253FReturnUrl%252525253D%25252525252FAccount%25252525252FLogin%25252525253FReturnUrl%25252525253D%2525252525252FAccount%2525252525252FLogin%2525252525253FReturnUrl%2525252525253D%252525252525

I do not have any error in the Event Viewer. But in the screen I see :

"HTTP Error 404.15 - Not Found The request filtering module is configured to deny a request where the query string is too long."

The website is running with the default setting in IIS Express. How can I fix this problem? I am guessing something is wrong with my Visual Studio 2013?

Edit

It works if I create a brand new website and I host it in IIS. But if I create a new website (without modifying anything) and just hit play (which start IIS Express by default), it doesn't.

Edit 2

I have deleted every websites in the Documents\IISExpress\config\applicationhost.config. I have recompiled everything, and it created this entry :

    <siteDefaults>
        <logFile logFormat="W3C" directory="%IIS_USER_HOME%\Logs" />
        <traceFailedRequestsLogging directory="%IIS_USER_HOME%\TraceLogFiles" enabled="true" maxLogFileSizeKB="1024" />
    </siteDefaults>
    <applicationDefaults applicationPool="Clr4IntegratedAppPool" />
    <virtualDirectoryDefaults allowSubDirConfig="true" />
</sites>

I am still getting the error with IIS Express, not with IIS.

score 68 · Answer 1 · answered Dec 08 '13 at 14:03

68

Highlight the project in Visual Studio

Open the 'Properties' panel on the right (or press F4)

Set 'Windows Authentication' to 'Disabled'

Set 'Anonymous Authentication' to 'Enabled'

answered Dec 08 '13 at 14:03

RobA2345

848
1
8
12

4

the key is Set 'Anonymous Authentication' to 'Enabled' – frank Dec 30 '13 at 06:41
16

But what if I really want Windows Authentication enabled and Anonymous Authentication disabled. This is because I want to get user's Windows login info for an intranet application. – David Nov 03 '14 at 20:03
Hi Rob, these are not properties of a Visual Studio project. They are settings in IIS Manager though. Setting them fixed the problem for me. – Jon Eldridge Apr 05 '17 at 09:30
Solved my issue!! Thanks!! – wadefanyaoxia Mar 05 '19 at 15:27

score 40 · Answer 2 · edited Jun 06 '17 at 16:37

40

You are missing [AllowAnonymous] attribute on login action.

[AllowAnonymous]
public ActionResult Login(string returnUrl)
{
    // code....
}

2nd possibility, specific to IIS Express only: is that, if you created same default WebApplication1 project multiple times, playing with different authentication settings, IIS Express stored additional authentication settings in it's configuration file. Something like:

    <location path="WebApplication1">
        <system.webServer>
            <security>
                <authentication>
                    <windowsAuthentication enabled="true" />
                    <anonymousAuthentication enabled="false" />
                </authentication>
            </security>
        </system.webServer>
    </location>
</configuration>

Configurations are in user's Documents folder Documents\IISExpress\config\, and you should look for:

applicationhost.config

Then just delete xml node <location path="WebApplication1"> mentioned above.

Update for VS 2015+

If you're using Visual Studio 2015 or higher, check this path for the config file: $(solutionDir)\.vs\config\applicationhost.config

Each solution will have its own config file.

edited Jun 06 '17 at 16:37

Ross Brasseaux

3,879
1
28
48

answered Oct 26 '13 at 01:08

Nenad

24,809
11
75
93

Nope. It's there by default and I have not changed anything. – Patrick Desjardins Oct 26 '13 at 14:14
Let me try it Give me few minutes – Patrick Desjardins Oct 26 '13 at 15:04
I have updated the question. Deleting the xml node doesn't fix the issue. – Patrick Desjardins Oct 26 '13 at 15:11
1

Not `site` section, it's separate `location` section at the bottom of file. And search for the name of your app. – Nenad Oct 26 '13 at 15:13
At no other place than the one I have written in the post that I see the application name. – Patrick Desjardins Oct 26 '13 at 15:48
The 1st possibility would be the answer if you have `filters.Add(new AuthorizeAttribute());` in the `RegisterGlobalFilters()` in your `FilterConfig`. – levininja Nov 20 '14 at 16:43
`LoginController` in @PatrickDesjardins's project (created from standard MVC project template is decorated with`[Authorize]` attribute on class-level. So `[AllowAnonymous]` attribute does the job for him. – Nenad Nov 20 '14 at 20:21
1

@Nenad I just spent hours troubleshooting this issue. I had a hunch that your answer was my solution, but the `applicationhost.config` file in the `Documents` folder did not reference my project, so I abandoned that approach—a decision, as it turned out, that was premature. Indeed, your answer was correct, however, the file location has changed in newer versions of Visual Studio (2015+). The file is now located in the solution's root directory. I have updated your answer to include this new information. Thank you. – Ross Brasseaux Jun 06 '17 at 16:41
IIS Express and the applicationhost.config file was my problem. I switched a project from windows authentication to using login accounts, and there was a lingering location node in this file which still had windowsauthentication set to true. – Kevin D. Apr 30 '19 at 23:38

user3573341 · Answer 3 · 2015-04-14T11:43:02.100

36

This issue is because of the authentication mode selected(by default) by the MVC 5 Template, which triggers the ReturnUrl Style of redirection that might lead to an infinite loop if not configured correctly.

To disable OWIN startup discovery,add this key to your webconfig file.

<add key="owin:AutomaticAppStartup" value="false"/>

edited Apr 14 '15 at 11:43

answered Apr 14 '15 at 11:31

user3573341

391
3
8

6

Wow, this resolved the issue for me. How on Earth was anyone supposed to find this? Thanks amigo. – enforge Aug 07 '15 at 15:04
This solved my issue too! How on Earth...? Anyone care to share what it is? EDIT: well, it no longer redirect to Login page and show 401 error instead? – Luke Vo Oct 07 '15 at 21:32
2

what if i need the owin startup? (infact i have set up a startup.cs) – Jogi Jan 22 '16 at 23:38
1

Now I can login, but it caused me an issue when logging out. It is not the optimum answer for me. Thanks, any way. – Dr. MAF Mar 13 '16 at 15:07
1

is this in appsettings? – Rez.Net Apr 05 '17 at 12:14

score 7 · Answer 4 · answered Mar 24 '14 at 12:53

7

I had to remove (Source Link):

<authorization>
  <deny users="?" />
</authorization>

answered Mar 24 '14 at 12:53

Alkemichar

81
1
3

After an upgrade with nuget update-package command it was my problem... strange that the update added those lines to web.config – Dragouf Jul 19 '14 at 02:21
That is very interesting because for me was the other way. I had to add this to make it work! – Exel Gamboa Dec 08 '16 at 14:15

score 7 · Answer 5 · answered Oct 07 '15 at 21:41

7

I know I may be late, and this is not directly for the OP's question. But if anyone in the future come here, one more check about AllowAnonymous and Authorize attribute is that, you have to check all child actions too.

For example, I had my Layout (which the Login page also use) that call 2 child actions for breadcrumbs and sidebar, and they did not have AllowAnonymous attribute (the Controller had Authorize attribute).

Hope this help.

answered Oct 07 '15 at 21:41

Luke Vo

17,859
21
105
181

It took me two hours to find your answer and then 2 mins to find the child action hidden in our layout which was missing the AllowAnonymous attribute. – nemesv Dec 06 '17 at 19:31
@nemesv Glad I could help :) Thanks for the bounty! – Luke Vo Dec 08 '17 at 11:17
I needed to add a ViewModel and Controller for my Navigation layout. Not having the [AllowAnonymous] on the NavBarController Index() action was causing an infinite loop of the Login() action. – Smitty-Werben-Jager-Manjenson Mar 18 '20 at 18:37

score 6 · Answer 6 · answered Aug 07 '15 at 19:23

6

In IIS, Select you website and check for Authentication, If you are using Forms Authentication then -

Set 'Windows Authentication' to 'Disabled' ,
Set 'Anonymous Authentication' to 'Enabled'
Set 'Forms Authentication' to 'Enabled'

answered Aug 07 '15 at 19:23

Sanjay Sharma

635
8
10

I received this error after our team had made some changes to the solution. This answer helped me so much. Thanks. – Dr. MAF Mar 13 '16 at 14:50

score 3 · Answer 7 · answered Sep 15 '15 at 15:47

ASP.Net MVC 5 template adds Microsoft.Owin and related libraries to the project. Since Owin infrastructure doesn't require Forms Authentication, the template also introduces the following key in web.config.

<system.webServer>
  <modules>
    <remove name="FormsAuthentication" />
  </modules>
</system.webServer>

Presence of this key could be a reason for undesirable looping back to Login page. Commenting it may help fix the problem for some people.

score 2 · Answer 8 · answered Dec 06 '13 at 08:52

2

I faced the same problem because my MVC project was configured for .Net 4.5 but I was using .Net 4.0 as my application pool in IIS. Switched it to .Net 4.5 application pool and the problem was fixed. I hope this helps some one else!

answered Dec 06 '13 at 08:52

Kam

517
6
7

score 2 · Answer 9 · answered Sep 09 '14 at 08:15

TL:DR? Do not call a protected web API (any web API which requires Authorization) from an authorization page such as ~/Account/Login (which, by itself, does NOT do this.). If you do you will enter into an infinite redirect loop on the server-side.

Cause

I found that the culprit was, indirectly, AccountController::Authorize and the fact that AccountController is decorated with [Authorize].

The root cause was Sammy() being called from HomeViewModel() (Line 6 of home.viewmodel.js), which was accessing a "protected web API". This was being done for /Account/Login, which resulted in /Account/Login redirecting to itself.

Confirmation

You can confirm this is the cause of your problem through several methods:

Decorate AccountController::Authorize with [AllowAnonymous]
Comment out the Sammy() calls made during viewmodel construction.

Solution

The solution was to only emit the app bundle (a.k.a "~/bundles/app") for views which already required authorization. To my knowledge /Account/ views are classic MVC-based views, and are not part of the app datamodel/viewmodel, but I had mistakenly moved the bundle Scripts.Render(@"~/bundles/app") call into _Layout.cshtml (causing protected web API calls to be made for all MVC views, including /Account/.)

score 2 · Answer 10 · answered Apr 01 '16 at 13:28

2

in my case: in my _layout.cshtml, i use Html.Action to call Action from Authorize Controller: ex: Html.Action("Count", "Product") -> loop error

fix: decorate by [AllowAnonymous] attribute in that Action (or remove these Html helper from _layout)

answered Apr 01 '16 at 13:28

TienQuang

99
3

score 2 · Answer 11 · answered May 11 '16 at 19:05

2

I just dealt with this issue for hours on end.

For me, it was in the Startup.Auth.cs file.

This code, when commented out, stopped the redirect loop.

        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Account/Login")
        });

answered May 11 '16 at 19:05

Nick

882
2
9
31

In my case, I only had to comment out "LoginPath = new PathString("/Account/Login")" – Ryan Dunphy Jan 11 '17 at 21:28
2

what you're suggesting is to just remove the entire login-redirect functionality. this doesn't seem like a valid solution to me. – Ross Brasseaux Jun 05 '17 at 22:30

score 1 · Accepted Answer · edited Sep 09 '14 at 08:40

Please be aware that this is potentially harmful advice, it's rarely a good idea to modify an applicationhost config file directly, there are usually tools that will do this for you, safely (for example, from within Visual Studio.) Before proceeding, be sure to create a backup copy of this file in the event your IIS Express becomes trashed.

To fix this problem, I took the default IIS configuration file located here :

C:\Windows\System32\inetsrv\config\applicationHost.config

To my document

%userprofile%\documents\iisexpress\config\applicationhost.config

And it worked.

This was because I had some Windows Authentification set and not the anonymous account.

this did not work for me only caused iisexpress to crash on startup — ozhug, Nov 06 '13 at 23:26

score 1 · Answer 13 · answered Nov 11 '15 at 17:19

1

Make sure you have no actions in pipeline that have authorize attribute. In my case, my layout had navigation menu controller which was missing allowAnonymous attribute.

answered Nov 11 '15 at 17:19

Kalyan

307
2
14

score 1 · Answer 14 · edited May 23 '17 at 11:46

1

I solved the same problem thanks to this accepted answer: ASP.NET Login Redirect Loop when user not in role.

It is possible that the controller containing Login action is decorated with an AuthorizeAttribute (even a custom one) while the login action is not decorated with AllowAnonymous attribute. Removing AuthorizeAttribute from the controller and adding AllowAnonymous to login action may be a possible solution.

edited May 23 '17 at 11:46

Community

1
1

answered Dec 15 '15 at 10:08

silviagreen

1,679
1
18
39

It may wide open other Actions that before were secured. – Mariusz Jul 31 '17 at 14:11

score 1 · Answer 15 · answered Oct 25 '16 at 08:55

These answers are more or less pieces of the same puzzle; I'll try to put everything in one place. Problem that OP described hit my application the moment I implemented the OWIN pipeline and AspNET Identity.

So let's see how to fix it...

OWIN Startup

I guess you need it, because if you don't, then you don't need authentication, and I guess you do. Except it you're using some old-style authentication, and I guess you don't. So, don't remove either the OWIN startup attribute...

[assembly: OwinStartupAttribute(typeof(YourApp.Probably_App_Start.SomethingLikeAuthConfig))]

...or the configuration line...

<add key="owin:AppStartup" value="YourApp.Probably_App_Start.SomethingLikeAuthConfig" />

Access restriction on controllers

Now we cleared this up, you need the authentication. This means either each of your controller needs the [Authorize] attribute, or you can do the same to all controllers in one place by registering the thing globally (e.g. in RegisterGlobalFilters(), add line filter.Add(new AuthorizeAttribute())). In the former case (when securing each controller separately) skip this part, just go to the next one. In the latter case all of your controllers will be secured against unauthorized acces, so you need an entry point for that authorization - unprotected Login() action. Just add...

[AllowAnonymous]

...and you should be good.

OWIN cookie configuration

When your user logs in, his browser stores encrypted (hopefully!) cookie in order to simplify things for the system. So, you need cookie - don't delete the line that says UseCookieAuthentication.

What you really have to do is turn off the IIS integrated authentication mechanism for your web application. This means switching off Windows Authentication (Disabled) and enable letting any user in, at least as long as IIS Express is now concerned, by setting Anonymous Authentication (Enabled).

When you start your web site, this will in turn copy these settings into IIS Express configuration (applicationhost.config), and there you should see these two lines:

<windowsAuthentication enabled="false" />
<anonymousAuthentication enabled="true" />

You might have the authorization config in your web.config that says deny users="?". It means the authorization subsystem is instructed to prevent anonymous users from entering. With OWIN, this still works as designed. You either have to remove this, or make your anonymous user able to access the Login page by using something like...

<location path="Account/Login"> <system.web> <authorization> <allow users="*" /> </authorization> </system.web> </location>

HTH

score 0 · Answer 16 · answered Feb 09 '15 at 19:18

I had similar issues where it was in an infinite loop when calling back to the website locally. It turns out that when debugging locally it was redirecting the ports. I updated port numbers in the project properties screen but left the Azure definition the same in the cloud project and everything started to work as expected.

score 0 · Answer 17 · answered Jul 14 '15 at 18:09

I had the same issue with my Asp.Net MVC 4 project. I resolved it by going to Startup.cs and commenting out the line for ConfigureAuth(app)

    public void Configuration(IAppBuilder app)
    {
        //ConfigureAuth(app);
    }

I also made sure that I had Windows Authentication enabled in IIS for my project, and all other authentication options disabled.

score 0 · Answer 18 · answered Feb 05 '16 at 15:19

0

For me, this turned out to be caused by my LoginViewModel containing references to translation resources files, apparently being protected by authentication. I removed those references, and the problem was solved.

answered Feb 05 '16 at 15:19

MichaelCleverly

2,473
1
24
33

score 0 · Answer 19 · answered Jun 15 '17 at 06:54

0

For me, removing the following block fixed it:

<authorization>
  <deny users="?" />
  <allow users="*" />
</authorization>

Assume

<authentication mode="None" />

answered Jun 15 '17 at 06:54

emragins

4,607
2
33
48

score 0 · Answer 20 · answered Jun 08 '19 at 12:08

0

in my case it was a very wired problem , i decorated the home controller by non existent role. so it causes a redirection loop.

answered Jun 08 '19 at 12:08

Baouche Iqbal

105
1
13

score -1 · Answer 21 · answered Jul 03 '14 at 15:33

Go to to your applicationhost.config file and set anonymousauthentication = "true"

<authentication>

            <anonymousAuthentication enabled="true" userName="" />
            <windowsAuthentication enabled="true">
                <providers>
                    <add value="Negotiate" />
                    <add value="NTLM" />
                </providers>
            </windowsAuthentication>

        </authentication>