tags:

views:

543

answers:

3

Hi!

I have an action handling a form post, but I want to make sure they are authenticated before the action. The problem is that the post data is lost because they user is redirected to the login page, and then back.

    [AcceptVerbs(HttpVerbs.Post)]
    [Authorize]
    public ActionResult AskQuestion(string question)
    {
       ....
    }

Any ideas?

Cheers

+3  A: 

A POST is usually used for an add, update, or delete of data. By the time the user is doing this, if authentication is needed, you should have already authenticated them. So I would suggest that you change the flow of your app to authenticate before the POST.

RedFilter
Whilst I agree with the principle of what you're saying, I don't agree that user data should be disposed of. It should be held, but not acted upon until the user can be authenticated. Otherwise, this makes for an unhelpful user experience when things like session timeouts happen.
Dan Atkinson
I am not suggesting that data should be discarded. I am suggesting that before you begin to collect that data, the user be authenticated. E.g., rather than presenting the form, present a link to the the form, and if the user is not authenticated yet, take them to the login screen first. It is better practice to have them authenticate first, because the user will be annoyed if, after filling out a form, they are then required to sing-up/authenticate before they can submit. If they do not wish to register at that point, then the site has made them waste their time.
RedFilter
A: 

You need to serialize your form values and a RedirectUrl to a hidden field.

After authentication deserialize the data in your hidden field and redirect based on the value of the RedirectUrl.

You will need a custom Authorize class to handle this.

Todd Smith
A: 

You can also use the session to save the information...

Eran Kampf