asp.net - Why would User.IsInRole return true, but AuthorizeAttribute not? -
i'm securing asp.net mvc 2 application, , have user in role "foo".
this true:
user.isinrole("foo")
but yet, when attempt lock down controller action following, user denied:
[authorize(roles = "foo")] public actionresult privatepage() { return view(); }
if isinrole reports true, why authorize attribute not allow user in?
it caused if storing persistent cookies forms authentication cookie. in scenario isinrole may check against cookie without verifying date login.
Comments
Post a Comment