Challenge() always redirects to Login Page - asp.net

Question

I am trying to authorize my Action method. Everything works fine but my Challenge() method always redirect to Login Page even if I've already logged in. I try to return Forbid() method and it redirects to Access Denied page as it should. What might be the problem with Challenge() method ?
public async Task<IActionResult> Edit(int id)
{
var project = await _context.Project.Include(p => p.OrganizationsLink).FirstOrDefaultAsync(p => p.Id == id);
if (project == null)
return NotFound();
//AUTHORIZATION
var allowed = await _authz.AuthorizeAsync(User, null, new ProjectEditRequirement(project));
if (!allowed.Succeeded)
return Challenge();
return View(project);
}

Answer 1

For Challenge, it is controlled by IAuthenticationService. AuthenticationService will call AuthenticateAsync to invoke the handler.AuthenticateAsync().
Not sure whether you implement custom IAuthenticationHandler, I will go deep the CookieAuthenticationHandler.
The complete workflow for CookieAuthenticaiton is below:
return Challenge() , for Challenge
public virtual ChallengeResult Challenge()
=> new ChallengeResult();
ChanllengeResult will call ExecuteResultAsync
public override async Task ExecuteResultAsync(ActionContext context)
{
if (context == null)
{
throw new ArgumentNullException(nameof(context));
}
var loggerFactory = context.HttpContext.RequestServices.GetRequiredService<ILoggerFactory>();
var logger = loggerFactory.CreateLogger<ChallengeResult>();
logger.ChallengeResultExecuting(AuthenticationSchemes);
if (AuthenticationSchemes != null && AuthenticationSchemes.Count > 0)
{
foreach (var scheme in AuthenticationSchemes)
{
await context.HttpContext.ChallengeAsync(scheme, Properties);
}
}
else
{
await context.HttpContext.ChallengeAsync(Properties);
}
}
context.HttpContext.ChallengeAsync will invoke ChallengeAsync
public static Task ChallengeAsync(this HttpContext context, string scheme, AuthenticationProperties properties) =>
context.RequestServices.GetRequiredService<IAuthenticationService>().ChallengeAsync(context, scheme, properties);
For CookieAuthenticationHandler
protected override async Task HandleChallengeAsync(AuthenticationProperties properties)
{
var redirectUri = properties.RedirectUri;
if (string.IsNullOrEmpty(redirectUri))
{
redirectUri = OriginalPathBase + Request.Path + Request.QueryString;
}
var loginUri = Options.LoginPath + QueryString.Create(Options.ReturnUrlParameter, redirectUri);
var redirectContext = new RedirectContext<CookieAuthenticationOptions>(Context, Scheme, Options, properties, BuildRedirectUri(loginUri));
await Events.RedirectToLogin(redirectContext);
}
As you could find, the HandleChallengeAsync redirect the action.
In my option, you could try return Forbid(), otherwise, you will need to override the HandleChallengeAsync.