title: ASP.NET MVC Authorize Attribute - NOT WORKING!
body: <p>Hey guys, I'm a bit frustrated here.  I'm not quite sure what's going on.  I started with the default MVC Project Template and proceeded to add a Controller ...</p>
  
  <pre><code>public class TestTemplatesController : EVController&lt;EvTestTemplate&gt;
  {
      //
      // GET: /Tests/
      [Authorize]
      public ActionResult Index()
      {
          ViewData.Model = EntityList;
          return View();
      }
  }
  </code></pre>
  
  <p>I added the Authorize attribute but it doesn't seem to apply.  Uauthenticated requests to the Controller are processed instead of redirecting to the .  I'm sure I'm missing something simple here, but I figured I'd ask.</p>
  
  <p>Thanks,</p>
  
  <p>pk</p>
  
  <hr>
  
  <p>Web.config:</p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;
  &lt;configuration&gt;
      &lt;configSections&gt;
          &lt;sectionGroup name="system.web.extensions" type="System.Web.Configuration.SystemWebExtensionsSectionGroup, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"&gt;
              &lt;sectionGroup name="scripting" type="System.Web.Configuration.ScriptingSectionGroup, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"&gt;
                  &lt;section name="scriptResourceHandler" type="System.Web.Configuration.ScriptingScriptResourceHandlerSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="MachineToApplication"/&gt;
                  &lt;sectionGroup name="webServices" type="System.Web.Configuration.ScriptingWebServicesSectionGroup, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"&gt;
                      &lt;section name="jsonSerialization" type="System.Web.Configuration.ScriptingJsonSerializationSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="Everywhere"/&gt;
                      &lt;section name="profileService" type="System.Web.Configuration.ScriptingProfileServiceSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="MachineToApplication"/&gt;
                      &lt;section name="authenticationService" type="System.Web.Configuration.ScriptingAuthenticationServiceSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="MachineToApplication"/&gt;
                      &lt;section name="roleService" type="System.Web.Configuration.ScriptingRoleServiceSection, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" allowDefinition="MachineToApplication"/&gt;
                  &lt;/sectionGroup&gt;
              &lt;/sectionGroup&gt;
          &lt;/sectionGroup&gt;
      &lt;/configSections&gt;
      &lt;appSettings/&gt;
      &lt;connectionStrings&gt;
          &lt;add name="ApplicationServices" connectionString="Data Source=evsql;Initial Catalog=EvTestCases;Persist Security Info=True;User ID=EvTestCaseUser;Password=**********" providerName="System.Data.SqlClient"/&gt;
          &lt;add name="EVTestCases.Data.Properties.Settings.EvTestCasesConnectionString" connectionString="Data Source=evsql;Initial Catalog=EvTestCases;Persist Security Info=True;User ID=EvTestCaseUser;Password=**********" providerName="System.Data.SqlClient"/&gt;
      &lt;/connectionStrings&gt;
      &lt;system.web&gt;
          &lt;!-- 
              Set compilation debug="true" to insert debugging 
              symbols into the compiled page. Because this 
              affects performance, set this value to true only 
              during development.
      --&gt;
          &lt;compilation debug="true"&gt;
              &lt;assemblies&gt;
                  &lt;add assembly="System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/&gt;
                  &lt;add assembly="System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
                  &lt;add assembly="System.Web.Abstractions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
                  &lt;add assembly="System.Web.Routing, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
                  &lt;add assembly="System.Web.Mvc, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
                  &lt;add assembly="System.Data.DataSetExtensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/&gt;
                  &lt;add assembly="System.Xml.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/&gt;
                  &lt;add assembly="System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/&gt;
              &lt;/assemblies&gt;
          &lt;/compilation&gt;
          &lt;authentication mode="Forms"&gt;
              &lt;forms loginUrl="~/Account/LogOn" timeout="2880"/&gt;
          &lt;/authentication&gt;
          &lt;membership&gt;
              &lt;providers&gt;
                  &lt;clear/&gt;
                  &lt;add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="ApplicationServices" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" passwordFormat="Hashed" maxInvalidPasswordAttempts="5" minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10" passwordStrengthRegularExpression="" applicationName="/"/&gt;
              &lt;/providers&gt;
          &lt;/membership&gt;
          &lt;profile&gt;
              &lt;providers&gt;
                  &lt;clear/&gt;
                  &lt;add name="AspNetSqlProfileProvider" type="System.Web.Profile.SqlProfileProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="ApplicationServices" applicationName="/"/&gt;
              &lt;/providers&gt;
          &lt;/profile&gt;
          &lt;roleManager enabled="false"&gt;
              &lt;providers&gt;
                  &lt;clear/&gt;
                  &lt;add connectionStringName="ApplicationServices" applicationName="/" name="AspNetSqlRoleProvider" type="System.Web.Security.SqlRoleProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"/&gt;
                  &lt;add applicationName="/" name="AspNetWindowsTokenRoleProvider" type="System.Web.Security.WindowsTokenRoleProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"/&gt;
              &lt;/providers&gt;
          &lt;/roleManager&gt;
          &lt;!--
              The &lt;customErrors&gt; section enables configuration 
              of what to do if/when an unhandled error occurs 
              during the execution of a request. Specifically, 
              it enables developers to configure html error pages 
              to be displayed in place of a error stack trace.
  
          &lt;customErrors mode="RemoteOnly" defaultRedirect="GenericErrorPage.htm"&gt;
              &lt;error statusCode="403" redirect="NoAccess.htm" /&gt;
              &lt;error statusCode="404" redirect="FileNotFound.htm" /&gt;
          &lt;/customErrors&gt;
      --&gt;
          &lt;pages&gt;
              &lt;controls&gt;
                  &lt;add tagPrefix="asp" namespace="System.Web.UI" assembly="System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
                  &lt;add tagPrefix="asp" namespace="System.Web.UI.WebControls" assembly="System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
              &lt;/controls&gt;
              &lt;namespaces&gt;
                  &lt;add namespace="System.Web.Mvc"/&gt;
                  &lt;add namespace="System.Web.Mvc.Ajax"/&gt;
                  &lt;add namespace="System.Web.Mvc.Html"/&gt;
                  &lt;add namespace="System.Web.Routing"/&gt;
                  &lt;add namespace="System.Linq"/&gt;
                  &lt;add namespace="System.Data.Linq"/&gt;
                  &lt;add namespace="System.Collections.Generic"/&gt;
                  &lt;add namespace="EVTestCases.Data"/&gt;
              &lt;/namespaces&gt;
          &lt;/pages&gt;
          &lt;httpHandlers&gt;
              &lt;remove verb="*" path="*.asmx"/&gt;
              &lt;add verb="*" path="*.asmx" validate="false" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
              &lt;add verb="*" path="*_AppService.axd" validate="false" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
              &lt;add verb="GET,HEAD" path="ScriptResource.axd" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" validate="false"/&gt;
              &lt;add verb="*" path="*.mvc" validate="false" type="System.Web.Mvc.MvcHttpHandler, System.Web.Mvc, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
          &lt;/httpHandlers&gt;
          &lt;httpModules&gt;
              &lt;add name="ScriptModule" type="System.Web.Handlers.ScriptModule, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
              &lt;add name="UrlRoutingModule" type="System.Web.Routing.UrlRoutingModule, System.Web.Routing, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
          &lt;/httpModules&gt;
      &lt;/system.web&gt;
      &lt;system.codedom&gt;
          &lt;compilers&gt;
              &lt;compiler language="c#;cs;csharp" extension=".cs" warningLevel="4" type="Microsoft.CSharp.CSharpCodeProvider, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"&gt;
                  &lt;providerOption name="CompilerVersion" value="v3.5"/&gt;
                  &lt;providerOption name="WarnAsError" value="false"/&gt;
              &lt;/compiler&gt;
              &lt;compiler language="vb;vbs;visualbasic;vbscript" extension=".vb" warningLevel="4" type="Microsoft.VisualBasic.VBCodeProvider, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"&gt;
                  &lt;providerOption name="CompilerVersion" value="v3.5"/&gt;
                  &lt;providerOption name="OptionInfer" value="true"/&gt;
                  &lt;providerOption name="WarnAsError" value="false"/&gt;
              &lt;/compiler&gt;
          &lt;/compilers&gt;
      &lt;/system.codedom&gt;
      &lt;system.web.extensions/&gt;
      &lt;!-- 
          The system.webServer section is required for running ASP.NET AJAX under Internet
          Information Services 7.0.  It is not necessary for previous version of IIS.
    --&gt;
      &lt;system.webServer&gt;
          &lt;validation validateIntegratedModeConfiguration="false"/&gt;
          &lt;modules runAllManagedModulesForAllRequests="true"&gt;
              &lt;remove name="ScriptModule"/&gt;
              &lt;remove name="UrlRoutingModule"/&gt;
              &lt;add name="ScriptModule" preCondition="managedHandler" type="System.Web.Handlers.ScriptModule, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
              &lt;add name="UrlRoutingModule" type="System.Web.Routing.UrlRoutingModule, System.Web.Routing, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
          &lt;/modules&gt;
          &lt;handlers&gt;
              &lt;remove name="WebServiceHandlerFactory-Integrated"/&gt;
              &lt;remove name="ScriptHandlerFactory"/&gt;
              &lt;remove name="ScriptHandlerFactoryAppServices"/&gt;
              &lt;remove name="ScriptResource"/&gt;
              &lt;remove name="MvcHttpHandler"/&gt;
              &lt;remove name="UrlRoutingHandler"/&gt;
              &lt;add name="ScriptHandlerFactory" verb="*" path="*.asmx" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
              &lt;add name="ScriptHandlerFactoryAppServices" verb="*" path="*_AppService.axd" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
              &lt;add name="ScriptResource" preCondition="integratedMode" verb="GET,HEAD" path="ScriptResource.axd" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
              &lt;add name="MvcHttpHandler" preCondition="integratedMode" verb="*" path="*.mvc" type="System.Web.Mvc.MvcHttpHandler, System.Web.Mvc, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
              &lt;add name="UrlRoutingHandler" preCondition="integratedMode" verb="*" path="UrlRouting.axd" type="System.Web.HttpForbiddenHandler, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"/&gt;
          &lt;/handlers&gt;
      &lt;/system.webServer&gt;
  &lt;/configuration&gt;
  </code></pre>