asked on 9/5/2013

Global.asax Infinite Redirect Loop Issue

I'm making some changes to my Forms Authentication to support authentication across multiple applications on the same server. Anyway, I've always had the below code in my Global.asax file:

If Session("UserID") Is Nothing Then
                    'we have an authenticated user
                    'with no current session
                    'so lets do this
                    'let's remove their authentication ticket
                    'then redirect them to logon.aspx
                    FormsAuthentication.SignOut()
                    Response.Redirect("Login.aspx")
                End If

Open in new window

Basically I use it so that any authenticated user without a session will be redirected back to the login page. However, this same code is now causing an infinite redirect looping problem. (in google chrome it says "This webpage has a redirect loop"). As soon as I comment the code out I don't have the issue. And more mysteriously, it only happens in DeBug mode

1) Do I even need this code? As soon as the session expires doesn't that also mean the auth ticket expired? Therefore all the redirecting will be handled by the built in forms authentication?

2) Why would it only be causing an issue in DeBug mode?

Thanks

.NET Programming

Last Comment

Kyle Abrahams, PMP

9/9/2013

ASKER CERTIFIED SOLUTION

Kyle Abrahams, PMP

9/5/2013

THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.

View this solution by signing up for a free trial.

Members can start a 7-Day free trial and enjoy unlimited access to the platform.

See Pricing Options

Start Free Trial

cat4larry

9/7/2013

ASKER

So would I stick a Session_OnEnd event into place and then if the session expires the user, after they click on something, get's routed back to the login screen? If I did that, wouldn't I still be stuck with an infinite loop?

Basically, I need to make sure that their authentication expiration and session timeout matches and make sure they get routed when one or the other doesn't exist.

D

Kyle Abrahams, PMP

9/9/2013

The session expire event should only happen once for user. There would be nothing to check regarding the session, and it should only redirect once.

Where is that code you posted actually running?

Another work around is to check if they're on the login page, then don't redirect.

eg:
if (!url.ToLower().Contains("login"))
Response.Redirect("Login.aspx");