Identity MVC登录成功后未跳转至授权Action Result问题求助

Hey there! Let's work through your login redirect and role validation issues step by step—this is a common gotcha in ASP.NET MVC/Core, so we'll get it sorted out quickly.

1. Fix the ReturnUrl Handling (The Root of Your Redirect Issue) #

Right now, when you try to access a protected page, ASP.NET automatically sends you to Account/Login with a ReturnUrl parameter pointing to the page you originally wanted. The problem is you’re probably ignoring this parameter and hardcoding RedirectToAction("Index","Home") instead. Here’s how to fix that properly:

First, update your Login action to prioritize the ReturnUrl (after validating it’s safe):

[HttpPost]
[AllowAnonymous]
public async Task<IActionResult> Login(LoginViewModel model, string returnUrl = null)
{
    // Validate the login form first
    if (!ModelState.IsValid)
    {
        return View(model);
    }

    // Your existing user validation logic (you said this works)
    var result = await _signInManager.PasswordSignInAsync(
        model.Email, 
        model.Password, 
        model.RememberMe, 
        lockoutOnFailure: false
    );

    if (result.Succeeded)
    {
        // Critical: Check if ReturnUrl is a valid local path (prevents malicious redirects)
        if (!string.IsNullOrEmpty(returnUrl) && Url.IsLocalUrl(returnUrl))
        {
            return Redirect(returnUrl); // Send user to their intended page
        }
        else
        {
            return RedirectToAction("Index", "Home"); // Fallback to default homepage
        }
    }

    // If login fails, show error
    ModelState.AddModelError(string.Empty, "Invalid email or password.");
    return View(model);
}

The Url.IsLocalUrl(returnUrl) check is non-negotiable here—it stops bad actors from tricking users into redirecting to external malicious sites.

2. Make Sure You’re Actually Logging the User In #

Even if you validate the user’s credentials, if you don’t create an authentication cookie, the system won’t recognize the user as logged in. That means when you try to redirect to a protected page, you’ll just get sent back to Login again.

If you’re using ASP.NET’s built-in SignInManager, the PasswordSignInAsync call handles this for you. But if you’re rolling your own validation, you need to manually create the claims principal and sign the user in:

// After validating the user exists and password is correct
var user = await _userManager.FindByEmailAsync(model.Email);

// Add claims (including role for authorization)
var claims = new List<Claim>
{
    new Claim(ClaimTypes.Name, user.Email),
    new Claim(ClaimTypes.Role, user.Role) // Add the user's role here!
};

var identity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
await HttpContext.SignInAsync(
    CookieAuthenticationDefaults.AuthenticationScheme, 
    new ClaimsPrincipal(identity)
);

// Now handle the ReturnUrl redirect as shown above

3. Get Role Validation Working #

To restrict access to actions by role, follow these steps:

• Add role claims during login: As shown in the code above, include the user’s role in their claims. This lets the authorization system check their role later.
• Use the [Authorize(Roles)] attribute: Apply this to any action or controller that needs role-based access:

// Example: Only admins can access this dashboard
[Authorize(Roles = "Admin")]
public IActionResult AdminDashboard()
{
    return View();
}

• Handle access denied cases: If a user logs in but doesn’t have the right role, they’ll be sent to an access denied page by default. Configure this in your startup code (Program.cs for .NET Core 6+):

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    {
        options.LoginPath = "/Account/Login";
        options.AccessDeniedPath = "/Account/AccessDenied"; // Customize this path
    });

Then create the corresponding action:

[AllowAnonymous]
public IActionResult AccessDenied()
{
    return View(); // Create a view to inform users they don't have permission
}

4. Debug Why RedirectToAction Isn’t Working #

If you still can’t get the redirect to fire, check these quick fixes:

• Check for ModelState errors: If your form has validation errors (like missing email/password), you’ll return the login view before reaching the redirect logic. Add a breakpoint to confirm you’re hitting the result.Succeeded block.
• Double-check action/controller names: Typos happen! Make sure RedirectToAction("Index", "Home") points to a real HomeController.Index() action.
• Clear browser cache: Sometimes browsers cache old redirects—test in incognito mode to rule this out.

内容的提问来源于stack exchange，提问作者Parvez