Authorize attribe not working with mvc 4 - asp.net

Question

I have code written for MVC 4 using visual studio 2012... and i am trying to achieve role based authorization but it seem [Authorize] is not working for some reason.... and i still can get page through url even its controller action is initialize with [Authorize] attribute... second can i even try to look whole application by putting following code in global
public static void RegisterGlobalFilters(GlobalFilterCollection filters)
{
filters.Add(new System.Web.Mvc.AuthorizeAttribute());
filters.Add(new HandleErrorAttribute());
}
my routing default set to login page as no unauthorized person can access to app
public static void RegisterRoutes(RouteCollection routes)
{
routes.IgnoreRoute("{resource}.axd/{*pathInfo}");
routes.MapRoute(
name: "Default",
url: "{controller}/{action}/{id}",
defaults: new { controller = "Account", action = "Login", id = UrlParameter.Optional }
);
}
and i trying to test by getting aa() view from directly url
[Authorize]
public class HomeController : Controller
{
public ActionResult Index()
{
return View();
}
[Authorize]
public ActionResult aa()
{
return View();
}
Login code
[Authorize]
[InitializeSimpleMembership]
public class AccountController : Controller
{
public ActionResult Login(string returnUrl)
{
ViewBag.ReturnUrl = returnUrl;
return View();
}
[HttpPost]
public ActionResult Login(LoginModel model, string returnUrl)
{
if (ModelState.IsValid && WebSecurity.Login(model._UserName, model._Password, persistCookie: false))
{
return RedirectToAction("Index", "Home");
}
ModelState.AddModelError("", "The user name or password provided is incorrect.");
return View(model);
}
and web.config
<authentication mode="Forms">
<forms loginUrl="~/Account/Login" timeout="2880" />
</authentication>

Answer 1

InitializeSimpleMembership needs to decorate your HomeController, NOT the AccountsController. As your HomeController/Index method is the entry point of your whole website, for [Authorize] to work, you need to have SimpleMembership initialized first, before anything else.

Answer 2

I've created new MVC4 website and faced same problem: how to force authorization (and redirect to login page if not authorized).
I'm beginner in ASP.NET, and couldn't find simple answer (there is a lot about this, especially at stackoverflow but no one of these answers helped me). I've finally get it done after hours, so maybe I will help someone with this.
Add filter to global filters, which will require authorization everywhere (unless you'll set AllowAnonymous, but about it later). Open App_Start/FilterConfig.cs and:
public static void RegisterGlobalFilters(GlobalFilterCollection filters)
{
filters.Add(new HandleErrorAttribute());
// Add this line
filters.Add(new AuthorizeAttribute());
}
Now we need to set authorization in config file. Open Web.config in root dir of project and:
<system.web>
// start of modification
// remove this line
<authentication mode="None" />
// add this lines
<authentication mode="Forms">
<forms loginUrl="~/Account/Login" timeout="30" protection="All"></forms>
</authentication>
<authorization>
<deny users="?" />
</authorization>
// end of modification
<compilation debug="true" targetFramework="4.5" />
<httpRuntime targetFramework="4.5" />
</system.web>
And thats all. Default login actions have [AllowAnonymous] tag by default so it just should work fine. It they not you need add them manually in Controllers/ like that:
[AllowAnonymous]
public ActionResult Login(string returnUrl)
{
ViewBag.ReturnUrl = returnUrl;
return View();
}
Hope helped someone.