Diagnosing login redirect loop

Question

My ISP has recently had several permission issues on my site which is hosted on a shared IIS box.

My MVC5 application has no code on the default page which requires authentication, but there are areas which do

I have webpublished my application to a subdirectory "test" and I'm currently getting a infinite redirect loop when I try to load any of the [AllowAnonymous] pages which as a result give a 404.

http://www.mywebsite.co.uk/test/Account/Login?ReturnUrl=%2Ftest%2FAccount%2FLogin%3FReturnUrl%3D%252Ftest%252FAccount%252FLogin%253FReturnUrl%253D%25252Ftest%25252FAccount%25252FLogin%25253FReturnUrl%25253D%2525252Ftest%2525252FAccount%2525252FLogin%2525253FReturnUrl%2525253D%252525252Ftest%252525252FAccount%252525252FLogin%252525253FReturnUrl%252525253D%25252525252Ftest%25252525252FAccount%25252525252FLogin%25252525253FReturnUrl%25252525253D%2525252525252Ftest%2525252525252FAccount%2525252525252FLogin%2525252525253FReturnUrl%2525252525253D%252525252525252Ftest%252525252525252FAccount%252525252525252FLogin%252525252525253FReturnUrl%252525252525253D%25252525252525252Ftest%25252525252525252FAccount%25252525252525252FLogin%25252525252525253FReturnUrl%25252525252525253D%2525252525252525252Ftest%2525252525252525252FAccount%2525252525252525252FLogin%2525252525252525253FReturnUrl%2525252525252525253D%252525252525252525252Ftest%252525252525252525252FAccount%252525252525252525252FLogin%252525252525252525253FReturnUrl%252525252525252525253D%25252525252525252525252Ftest%25252525252525252525252FAccount%25252525252525252525252FLogin%25252525252525252525253FReturnUrl%25252525252525252525253D%2525252525252525252525252Ftest%2525252525252525252525252FAccount%2525252525252525252525252FLogin%2525252525252525252525253FReturnUrl%2525252525252525252525253D%252525252525252525252525252Ftest%252525252525252525252525252FAccount%252525252525252525252525252FLogin%252525252525252525252525253FReturnUrl%252525252525252525252525253D%25252525252525252525252525252Ftest%25252525252525252525252525252FAccount%25252525252525252525252525252FLogin%25252525252525252525252525253FReturnUrl%25252525252525252525252525253D%2525252525252525252525252525252Ftest%2525252525252525252525252525252FAccount%2525252525252525252525252525252FLogin%2525252525252525252525252525253FReturnUrl%2525252525252525252525252525253D%252525252525252525252525252525252Ftest%252525252525252525252525252525252FAccount%252525252525252525252525252525252FLogin%252525252525252525252525252525253FReturnUrl%252525252525252525252525252525253D%25252525252525252525252525252525252Ftest%25252525252525252525252525252525252Fhome%25252525252525252525252525252525252Ffeedback

(i think this 404 is the result of a query string too long)

If I webpublish to test2 the "same" code works without this issue.

I've tried removing items from the _layout.cshtml to see if I can spot what call is causing this but after stripping all items out I still get this error.

Does anyone have any suggestions what I can use to diagnose where the problem lies?

Answer 1

Usually that is the problem, that Login page does not allow unauthorized users: you get endless loop - unauthorized user is not allowed to see login page, so he is redirected to login page to get authorization.

So either need [AllowAnonymous] attribute on your login action in controller or add to web.config:

 <location path="/test/account/login">
  <system.web>
     <authorization>
        <allow users="?"/>
     </authorization>
  </system.web>
 </location>