title: Application_AuthenticateRequest infinite loop
body: <p>I recently added Forms-based Authentication to an MVC 3 project.  There seems to be a problem between my Application_AuthenticateRequest function(Global.asax.cs file) and my settings for my Web.Config file because my Application_AuthenticateRequest function seems to get called infinitely.  How can I change my configurations for this to work properly and how can I allow a user access to both the login page and the default page, while still denying access to the other pages?</p>
  
  <pre><code>    //Global.asax.cs
      protected void Application_AuthenticateRequest(object sender, EventArgs e)
      {
          // Extract the forms authentication cookie
          string cookieName = FormsAuthentication.FormsCookieName;
          HttpCookie authCookie = Context.Request.Cookies[cookieName];
  
          if (null == authCookie)
          {
              // There is no authentication cookie.
              return;
          }
  
          FormsAuthenticationTicket authTicket = null;
          try
          {
              authTicket = FormsAuthentication.Decrypt(authCookie.Value);
          }
          catch (Exception ex)
          {
              // Log exception details (omitted for simplicity)
              return;
          }
  
          if (null == authTicket)
          {
              // Cookie failed to decrypt.
              return;
          }
  
          string[] roles = authTicket.UserData.Split('|');
  
          // Create an Identity object
          FormsIdentity id = new FormsIdentity(authTicket);
  
          // This principal will flow throughout the request.
          UserPrincipal principal = new UserPrincipal(id, roles);
          // Attach the new principal object to the current HttpContext object
          Context.User = principal;
          Thread.CurrentPrincipal = principal;
  }
  
  //Web.Config
  &lt;authentication mode="Forms"&gt;
    &lt;forms loginUrl="~/Account/LogOn" 
           protection="All"
           cookieless="UseCookies"
           slidingExpiration="false"
           timeout="30" /&gt;
  &lt;/authentication&gt;
  
  &lt;authorization&gt;
    &lt;deny users="?" /&gt;
    &lt;allow users="*"/&gt;
  &lt;/authorization&gt;
  </code></pre>