Request from desktop client hits the wrong controller action - asp.net

Question

From a Windows Forms desktop application, I make a request to an end-point in my ASP.NET MVC Web Application (not Web API).
The request is made for the endpoint "~/Account/APILogin" but it hits the "~/Account/Login" (GET) action even when I am making a post request to the former. Why is that so?
Here are the relevant bits of code:
In the ASP.NET MVC Application
class AccountController : Controller
{
// The request comes to this guy
[AllowAnonymous]
public ActionResult Login(string returnUrl)
{
// get request for Web browser clients
ViewBag.ReturnUrl = returnUrl;
return View();
}
[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public async Task<ActionResult> Login(LoginViewModel model, string returnUrl)
{
// post request for Web browser clients
}
// It should really have hit this
[HttpPost]
public JsonResult APILogin(LoginRequest loginRequest)
{
if (loginRequest == null || string.IsNullOrEmpty(loginRequest.UserName) || string.IsNullOrEmpty(loginRequest.Password))
{
return Json(LoginResult.CreateFailure("Invalid login. Please try again."));
}
var hashedPassword = UserManager.PasswordHasher.HashPassword(loginRequest.Password);
var user = BusinessManager.GetUser(loginRequest.UserName, hashedPassword);
if (user == null)
{
return Json(LoginResult.CreateFailure("Invalid login. Please try again."));
}
return Json(LoginResult.CreateSuccess());
}
}
In the Global.asax of the ASP.NET MVC Web Application
public class MvcApplication : System.Web.HttpApplication
{
protected void Application_Start()
{
AreaRegistration.RegisterAllAreas();
FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters);
RouteConfig.RegisterRoutes(RouteTable.Routes);
BundleConfig.RegisterBundles(BundleTable.Bundles);
ValueProviderFactories.Factories.Add(new JsonValueProviderFactory());
}
}
In the Windows Forms desktop client application
private async void btnOk_Click(object sender, EventArgs e)
{
var client = new Client();
var loginRequest = new LoginRequest { UserName = txtUserName.Text.Trim(), Password = txtPassword.Text.Trim() };
var loginResult = await client.LoginAsync(loginRequest);
if (loginResult.Succeeded)
{
Close();
}
else
{
ReportInvalidLogin(loginResult.FailureMessage);
}
}
In a class library that makes the HTTP Request on behalf of clients to the ASP.NET Web Web Application
class Client : IDisposable
{
private WebClient _webClient = null;
private string _baseUrl = null;
public Client()
{
_webClient = new WebClient();
_baseUrl = ConfigurationManager.AppSettings["WebApplicationBasePath"];
if (string.IsNullOrEmpty(_baseUrl))
{
throw new ArgumentNullException("Please add a key named WebApplicationBasePath to the configuration file with the base Url of the server web application.");
}
}
public async Task<LoginResult> LoginAsync(LoginRequest loginRequest)
{
var loginUrl = string.Format($"{_baseUrl}Account/APILogin");
var data = await Task.Factory.StartNew<string>(() => JsonConvert.SerializeObject(loginRequest));
_webClient.Headers.Add(HttpRequestHeader.ContentType, "application/json");
var responseString = await _webClient.UploadStringTaskAsync(loginUrl, "POST", data);
var loginResult = await Task.Factory.StartNew<LoginResult>(() =>
JsonConvert.DeserializeObject<LoginResult>(responseString));
return loginResult;
}
}
I do not have an AuthorizeAttribute applied yet, so that, too, as a possible cause is out of the question.

Answer 1

Somewhere in your stack (possibly IIS settings, web.config, or applying a global filter) authentication is being required for all requests, unless explicitly marked with the [AllowAnonymous] attribute. The solution is simple, add that attribute:
[HttpPost]
[AllowAnonymous]
public JsonResult APILogin(LoginRequest loginRequest)