FormsAuthentication.RedirectFromLoginPage – really strange and inconsistent results

Question

Hi,

I’m trying to figure out whether FormsAuthentication.RedirectFromLoginPage (called inside method M()), performs redirection the moment method M finishes its execution, or whether page first completes its lifecycle and only then redirects. But I can't figure it out due to inconsistent behavior:

protected void Page_Load(object sender, EventArgs e)
{
    if (IsPostBack)
    {
        FormsAuthentication.RedirectFromLoginPage("someUser", false);
    }


protected void LogOut_Click(object sender, EventArgs e)
{
    FormsAuthentication.SignOut();
    Session["LogOut"] = "LogOut_Click event handler";
}

protected void ClickMe_Click(object sender, EventArgs e)
{
    Session["ClickMe"] = "ClickMe_click event handler";
}

If on postback user clicks LogOut button, then *LogOut_Click()* is executed prior to page being redirected. But if on postback user clicks on ClickMe button, the page is redirected before *ClickMe_Click* event handler is called.

Why is that? Thus, based on what criteria does FormsAuthentication.RedirectFromLoginPage decide which event handlers should be executed before the redirection?

thanx

EDIT:

The FormsAuthentication.RedirectFromLoginPage() method has nothing to do with logging out. It's used to manually log someone in and redirect them to the page they were originally trying to access.

I didn’t imply that it has anything to do with logging out

However, looking at your code samples, you could be asking why the code continues to execute in the LogOut_Click function even if the user is logged out.

No, I didn’t ask that either.

Now, it also occurs to me that you could be asking about FormsAuthentication.RedirectToLoginPage instead of RedirectFromLoginPage.

I didn’t ask that either

What I’m asking is why when FormsAuthentication.RedirectFromLoginPage is called inside Page_Load, if postback was caused by LogOut button, then LogOut_Click() method does run before page is redirected, but if ClickMe button causes the postback, ClickMe_Click() event handler doesn’t have a chance to run before a page is redirected. In other words, I would expect that ClickMe_Click would also have a chance to run before page was redirected ( assuming ClickMe button caused a postback )

Answer 1

Edit - new answer

OK. I see that I did mis-read the question completely. Sorry.

I'm posting this new answer, but I'm afraid I'm still not going to answer the "why" for you. I do know this.

According to the remarks section documentation for the Response.Redirect method, it says

Redirect calls End which raises a ThreadAbortException exception upon completion.

However, in the documentation for FormsAuthentication.RedirectFromLoginPage() there is no similar remark. IN know that no documentation is perfect, but Microsoft does a very good job with the MSDN library, so I can only assume that the reason for this is that they chose not t call End in the FormsAuthentication.RedirectFromLoginPage() method for some reason. Perhaps an oversight?

At any rate, to me, this seems like a mistake. You'd think that both methods would act the same, since both are redirect methods, which of course, is not an answer to your question. I guess now I'm just still in the same boat as you, wondering why this is.

I'm sure you've already figured this out, but I believe you could get around this by just using a normal Response.Redirect method and not using FormsAuthentication.RedirectToLoginPage. In all honesty, I've never seen the RedirectToLoginPage used before, so I'm curious as to why you would use it instead of Response.Redirect.

End Edit - original answer below

I'm not sure I'm reading this properly.

The FormsAuthentication.RedirectFromLoginPage() method has nothing to do with logging out. It's used to manually log someone in and redirect them to the page they were originally trying to access.

However, looking at your code samples, you could be asking why the code continues to execute in the LogOut_Click function even if the user is logged out. That's pretty simple to answer. The security permissions are checked when the Application_AuthenticateRequest event fires, which is prior to the event handling code.

So even though you've logged the user out, the user was authenticated at the time the credentials were checked. The runtime won't check the credentials again as long as the user is in that page.

I was trying to think of a real-world comparison and came up with this. In our company we have a swipe card that we have to use to get in the building and in certain sensitive areas. If I'm employed at the beginning of the day, and get fired later in the day, I'm still in the building. I can clean out my desk, etc. So I can still do things inside the building as long as I haven't left it yet.

That applies to your code as well... The user is already authenticated and in the page execution life cycle, so the code is allowed to continue.

Whether this SHOULD be this way is open for debate. Microsoft could have coded it so that calling FormsAuthentication.SignOut() also optionally terminates the processing similar to Response.Redirect, but apparently based on your code sample they didn't. Instead, calling SignOut() only removes the authentication cookie.

http://msdn.microsoft.com/en-us/library/system.web.security.formsauthentication.signout.aspx

Now, it also occurs to me that you could be asking about FormsAuthentication.RedirectToLoginPage instead of RedirectFromLoginPage. However, you don't show RedirectToLoginPage in your code or any other part of your question. If you want to log people out and redirect to the loin page immediately, you need to call FormsAuthentication.SignOut() followed by FormsAuthentication.RedirectToLoginPage() as shown in the link I posted above.

Answer 2

Okay,

From what I can tell from trying out this scenario is this.

The redirect doesn't stop the page from finishing it's lifecycle.

Microsoft should have added another overload for RedirectFromLoginPage that included 'endResponse' like it did for Response.Redirect. Unfortunately they didn't. Being that the Page_Load runs before any of the postback events, and that you are calling the RedirecFromLoginPage before the event fires you will need to stop the current page from finishing it's currently processing life cycle.

It's far from elegant, however putting a

FormsAuthentication.RedirecFromLoginPage("someUser", false);    
Response.End();

after your RedirectFromLoginPage to discontinue the current page lifecycle and therefore stopping any other events firing and you should get the action you are looking for. At least I hope. This will however cause a 'System.Threading.ThreadAbortException' just like if you were to pass true in to Response.Redirect as the 'endResponse' parameter.

Hope this helps.