title: "Cannot redirect after http headers have been sent", but Response.Redirect doesn't work if I remove RedirectToAction
body: <p>So I'm trying to recycle some code that was for a 'code behind' patterned .NET app for my MVC app and the Authenticate class they used. How the SignInController's Index method based on the code they gave me is supposed to work is to call an Authenticate class method in the <code>else if</code> which gets a token and redirects back to the Index method at which point since the app now has a token, it goes into the first <code>if</code> conditional and a different method in the aforementioned Authenticate validates the token. Since users will not start out with a token, the <code>else if</code> will always be dove into first.</p>
  
  <p>In order to soothe the "Not all code paths return a value" error I have to add a return statement at the end of the <code>else if</code> clause and an <code>else</code> clause. However, if I <code>return null</code> Index doesn't get redirected to as confirmed by breakpoints. However, if I do <code>return RedirectToAction("Index", "SignIn");</code> I get an error about "Cannot redirect after HTTP headers have been sent" which I suspect is because the <code>Redirect</code> call from the Authenticate class hasn't been completed yet. However I'm at odds as to how to remedy situation as either return value fails to redirect the web app back to Index...</p>
  
  <p><strong>Original "look behind" styled .NET code that I'm trying to recycle from a colleague's app:</strong></p>
  
  <pre><code>if (string.IsNullOrEmpty(HttpContext.Current.User.Identity.Name) &amp;&amp;  HttpContext.Current.Request.QueryString["Token"] != null)
  {
  // we’ve got a token, they must have logged in .. double-check the token
  string ssoToken = HttpContext.Current.Request.QueryString["Token"].ToString();
  string userRoles = string.Empty;
    if (Authenticate.ValidateSSOToken(ssoToken, out userRoles))
    {
        string userName = HttpContext.Current.User.Identity.Name;
        ((BaseApplicationPage)(this.Page)).CurrentSecurity.SetUser(userName, "", userRoles);
        RedirectOnSuccess();
  
    }
    else
    {
        RedirectToForbiddenPage();
    }
  }
  else if(string.IsNullOrEmpty(HttpContext.Current.User.Identity.Name))
  {
     // no user data..go ask them to get SSOToken from service
     Authenticate.isUserAuthenticated();
  }
  </code></pre>
  
  <p><strong>My attempt to repurpose it into a MVC styled .NET app:</strong></p>
  
  <pre><code>        public ActionResult Index()
          {
              if (string.IsNullOrEmpty(System.Web.HttpContext.Current.User.Identity.Name) &amp;&amp; System.Web.HttpContext.Current.Request.QueryString["Token"] != null)
              {
                  // we’ve got a token, they must have logged in ... double-check the token
                  string ssoToken = System.Web.HttpContext.Current.Request.QueryString["Token"].ToString();
                  string userRoles = string.Empty;
                  if (Authenticate.ValidateSSOToken(ssoToken, out userRoles))
                  {
                      string userName = System.Web.HttpContext.Current.User.Identity.Name;
                      //((BaseApplicationPage)(this.Page)).CurrentSecurity.SetUser(userName, "", userRoles);
                      //RedirectOnSuccess();
  
                      // TODO: Not sure what the MVC equivalent would be for commented out code above
                      return RedirectToAction("Index", "Checklist");   
                  }
                  else
                  {
                      //RedirectToForbiddenPage();
  HttpStatusCodeResult(HttpStatusCode.Forbidden);
                  }
              }
              else if (string.IsNullOrEmpty(System.Web.HttpContext.Current.User.Identity.Name))
              {
                  // no user data...go ask them to get SSOToken from service
                  Authenticate.isUserAuthenticated();
                  return null; // Screwed if I don't return anything because of build error, screwed if I do return something because it messes with the redirect
              }
              else
              {
                  return null;
              }
          }
  </code></pre>
  
  <p>Authenticate class snippet at the end of <code>isUserAuthenticated</code> that gets the token:</p>
  
  <pre><code>//string RedirectURL = GetBaseVirtualDirectory() + "/SignIn/Index";
  string RedirectURL = "https://localhost:XXXX1/SignIn/Index";
  HttpContext.Current.Response.Redirect(authServiceURL + "/Windows/Auth?RedirectURL=" + RedirectURL, true);
  </code></pre>