ASP.NET MVC 5 : Endless redirect to the login page using the site template

Question

I just started using ASP.NET MVC 5 (I already used the previous versions quite a lot) and I have a very weird issue: I created a new website using the Visual Studio 2013 (fully updated) ASP.NET template. For the template options I selected the MVC template, "Individual User Accounts" authentication type, no cloud hosting, and no other components than the core MVC library. After I validate the options, I update all the NuGet packages. And after that I press F5 (without opening or modifying any of the new project files).

The browser opens only to show an error page, because of an endless redirection loop: the URL shows :

http://localhost:24585/Account/Login?ReturnUrl=%2FAccount%2FLogin%3FReturnUrl%3D%252FAccount%252FLogin%253FReturnUrl%253D%25252FAccount%25252FLogin%25253FReturnUrl%25253D%2525252FAccount%252525<snip>

Again, this is with the stock, unmodified ASP.NET MVC template. I did check that the login URL is defined in the cookie auth options, and that looks good :

// Configure the sign in cookie
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
    LoginPath = new PathString("/Account/Login"),
    Provider = new CookieAuthenticationProvider
    {
        // Enables the application to validate the security stamp when the user logs in.
        // This is a security feature which is used when you change a password or add an external login to your account.  
        OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
            validateInterval: TimeSpan.FromMinutes(30),
            regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
    }
});            

The only thing that could maybe break the default website is something in the global web.config/machine.config files, although I usually avoid messing with them on my dev box. Launching the template without updating the NuGet packages does not solve the issue. There's probably something wrong with the ASP.NET Identity lib, but I don't really know it and I couldn't find any relevant info related to my issue.

Question: Does anyone know what the problem is, or at least what's the best way to troubleshoot this ?

Thanks

Answer 1

Ok so after a good night's sleep I ended up finding what's wrong: the problem was in the IIS Express configuration, which was not reset for some reason when I created a new project, and probably inherited a previous project's settings. It had Anonymous Authentication disabled and Windows Authentication enabled, which is not compatible with the default web.config created by the template, since it had authentication mode set to None. So IIS was expecting a Windows authentication before any resource is served, and the website did not ask for Windows credentials. And there we have an infinite loop.

TL;DR If you have that same problem, check the project properties (select the project in the solution explorer, and press F4). The Anonymous Authentication entry should be set to Enabled, and the Windows Authentication entry should be set to Disabled. Note that this is only valid if you do not select Windows Authentication in the template settings !