title: MVC 4 Forms Authentication not working with [Authorize]
body: <p>I'm learning MVC4 right now, and I am following the Pro ASP NET MVC4 4th edition book to create a Sports Store project.</p>
  
  <p>I have always developed in webforms, and I am trying to figure out how the forms authentication is working in MVC4.</p>
  
  <p>Here is what I have achieved:</p>
  
  <blockquote>
    <p>Web.Config</p>
  </blockquote>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
  &lt;forms loginUrl="~/Account/Login" timeout="2880"/&gt;  &lt;/authentication&gt;
  </code></pre>
  
  <blockquote>
    <p>AccountController login Action:</p>
  </blockquote>
  
  <pre><code>[HttpPost]
          public ActionResult Login(LoginViewModel model, string returnUrl)
          {
              if (ModelState.IsValid)
              {
                  if (authProvider.Authenticate(model.UserName, model.Password))
                  {
                      return Redirect(returnUrl ?? Url.Action("Index", "Admin"));
                  }
                  else
                  {
                      ModelState.AddModelError("", "Incorrect username or password");
                      return View();
                  }
              }
              else
              {
                  return View();
              }
          }
  </code></pre>
  
  <blockquote>
    <p>Auth Provider:</p>
  </blockquote>
  
  <pre><code>public bool Authenticate(string username, string password) {
              bool result = FormsAuthentication.Authenticate(username, password);
              if (result)
              {
                  FormsAuthentication.SetAuthCookie(username, false);
              }
  
              return result;
  
          }
  </code></pre>
  
  <p>I am setting the AuthCookie and now I would like to know, how to protect other controllers
  and actions out of the AccountController</p>
  
  <p>The application has a controller called AdminController, where you can edit products and the<br>
  product list in under the following {controller/action}</p>
  
  <blockquote>
    <p>Admin/Index</p>
  </blockquote>
  
  <p>So, If I am not missunderstanding the theory, if the user is not logging in the AccountController they should not be able to call actions with [Authorize] tag
  on declaration:</p>
  
  <pre><code> public class AdminController : Controller
      {
          private IProductRepository repository;
  
  
          public AdminController(IProductRepository repo)
          {
              repository = repo;
          }
  
         [Authorize]
          public ActionResult Index()
          {
  
              return View(repository.Products);
          }
     }
  </code></pre>
  
  <p>The thing is I can call the Index action of the Admin Controller without any problem and without introducing the login.</p>
  
  <p>I need some guidance to understand how this works. I have done some research and could not find anything, and the book is not covering this topic.</p>
  
  <p>Thanks in advance.</p>
  
  <p><strong>EDIT: I closed Chrome Browser and worked without changing anything. I was working with tabs and I guess the cookie was active even stopping and starting debugging.</strong></p>