title: having an issue with membership credential verification failed when it shouldn't be using it
body: <p>Since our website cannot take credit cards directly we are routing the user, with credential and other misc variables, to a 'hosted page' on another site.</p>
  
  <p>To go more in detail, this is how the user would access this generally:</p>
  
  <ol>
  <li><p>Go to our site and login with a username and password that they created previously. This uses the asp.net membership provider.</p></li>
  <li><p>Once logged in, we show them their account and they have a button to make a payment. Once they click this...</p></li>
  <li><p>They are prompted with a 'prepayment' page to verify the amount and various other bits of information. They click continue from here...</p></li>
  <li><p>So, the payment page is displayed within an iframe of our website. We redirect them to the external hosted webpage with the following code:</p>
  
  <p>&lt; div align="center"> 
    &lt; iframe  width="100%" height="600px" src="@Html.Raw(@ViewBag.GateWayWebsite)">
  &lt; /div></p></li>
  <li><p>Once the payment page has been entered and the customer clicks submit, that site submits a <strong>post</strong> back to our website where they began and passes back the information about the charge. I grab this information and save it to our database and display a receipt.</p></li>
  </ol>
  
  <p>Everything works fine except for #5. That works most of the time but about 1 in 10 come back with this message:</p>
  
  <pre><code>Event code: 4006 
  Event message: Membership credential verification failed. 
  Event time: 12/16/2013 4:32:22 AM 
  Event time (UTC): 12/16/2013 12:32:22 PM 
  Event ID: 42c509f2a25d46f0af17e72a52dfbbe5 
  Event sequence: 38 
  Event occurrence: 1 
  Event detail code: 0 
  
  Application information: 
      Application domain: /LM/W3SVC/3/ROOT/SuburbanCustPortal-1-130316693110399868 
      Trust level: Full 
      Application Virtual Path: /SuburbanCustPortal 
      Application Path: C:\inetpub\wp\SuburbanCustPortal\ 
      Machine name: WIN-OB929P97YAR 
  
  Process information: 
      Process ID: 3620 
      Process name: w3wp.exe 
      Account name: NT AUTHORITY\NETWORK SERVICE 
  
  Request information: 
      Request URL: https://myurl:443/SuburbanCustPortal/Account/Logon2 
      Request path: /SuburbanCustPortal/Account/Logon2 
      User host address: xx.xx.xx.xx 
      User:  
      Is authenticated: False 
      Authentication Type:  
      Thread account name: NT AUTHORITY\NETWORK SERVICE 
  
  Name to authenticate: testuser 
  </code></pre>
  
  <p>I cannot get to happen on the handful of test cases that I've run which makes it that much more frustrating.</p>
  
  <p>This is my web.config:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;?xml version="1.0"?&gt;
  &lt;!--
    For more information on how to configure your ASP.NET application, please visit
    http://go.microsoft.com/fwlink/?LinkId=152368
    --&gt;
  &lt;configuration&gt;
  
    &lt;appSettings&gt;
      &lt;add key="webpages:Version" value="1.0.0.0"/&gt;
      &lt;add key="ClientValidationEnabled" value="true"/&gt;
      &lt;add key="UnobtrusiveJavaScriptEnabled" value="true"/&gt;
      &lt;add key="suburbanServiceUrl" value=""/&gt;
    &lt;/appSettings&gt;
  
    &lt;system.web&gt;
  
      &lt;sessionState
        mode="InProc"
        stateConnectionString="tcpip=127.0.0.1:42424"
        stateNetworkTimeout="60"
        sqlConnectionString="data source=127.0.0.1;Integrated Security=SSPI"
        cookieless="false"
        timeout="60"
      /&gt;
  
      &lt;customErrors mode="Off"/&gt;
      &lt;compilation debug="true" targetFramework="4.0"&gt;
        &lt;assemblies&gt;
          &lt;add assembly="System.Web.Abstractions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
          &lt;add assembly="System.Web.Helpers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
          &lt;add assembly="System.Web.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
          &lt;add assembly="System.Web.Mvc, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
          &lt;add assembly="System.Web.WebPages, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/&gt;
        &lt;/assemblies&gt;
      &lt;/compilation&gt;
      &lt;authentication mode="Forms"&gt;
        &lt;!-- timeout: Gets and sets the amount of time, in minutes, allowed between requests
                      before the session-state provider terminates the session. --&gt;
        &lt;forms loginUrl="~/Account/LogOn" timeout="60"/&gt;
      &lt;/authentication&gt;
  
      &lt;membership&gt;
        &lt;providers&gt;
          &lt;clear/&gt;
          &lt;add name="AspNetSqlMembershipProvider"
               type="System.Web.Security.SqlMembershipProvider"
               connectionStringName="ApplicationServices"
               enablePasswordRetrieval="false"
               enablePasswordReset="true"
               requiresQuestionAndAnswer="false"
               requiresUniqueEmail="true"
               maxInvalidPasswordAttempts="30"
               minRequiredPasswordLength="6"
               minRequiredNonalphanumericCharacters="0"
               passwordAttemptWindow="10"
               applicationName="webportal"/&gt;
        &lt;/providers&gt;
  
      &lt;/membership&gt;
  
      &lt;profile&gt;
        &lt;providers&gt;
          &lt;clear/&gt;
          &lt;add name="AspNetSqlProfileProvider" type="System.Web.Profile.SqlProfileProvider" connectionStringName="ApplicationServices" applicationName="/"/&gt;
        &lt;/providers&gt;
      &lt;/profile&gt;
  
      &lt;roleManager enabled="true"&gt;
        &lt;providers&gt;
          &lt;clear/&gt;
          &lt;add name="AspNetSqlRoleProvider" type="System.Web.Security.SqlRoleProvider" connectionStringName="ApplicationServices" applicationName="/"/&gt;
          &lt;add name="AspNetWindowsTokenRoleProvider" type="System.Web.Security.WindowsTokenRoleProvider" applicationName="/"/&gt;
        &lt;/providers&gt;
      &lt;/roleManager&gt;
  
      &lt;pages enableSessionState="true"&gt;
        &lt;namespaces&gt;
          &lt;add namespace="System.Web.Helpers"/&gt;
          &lt;add namespace="System.Web.Mvc"/&gt;
          &lt;add namespace="System.Web.Mvc.Ajax"/&gt;
          &lt;add namespace="System.Web.Mvc.Html"/&gt;
          &lt;add namespace="System.Web.Routing"/&gt;
          &lt;add namespace="System.Web.WebPages"/&gt;
        &lt;/namespaces&gt;
      &lt;/pages&gt;
    &lt;/system.web&gt;
  
    &lt;system.webServer&gt;
      &lt;validation validateIntegratedModeConfiguration="false"/&gt;
      &lt;modules runAllManagedModulesForAllRequests="true"&gt;
        &lt;remove name="Session"/&gt;
        &lt;add name="Session" type="System.Web.SessionState.SessionStateModule"/&gt;
      &lt;/modules&gt;
      &lt;httpProtocol&gt;
      &lt;/httpProtocol&gt;
      &lt;staticContent&gt;
        &lt;clientCache cacheControlCustom="public"
        cacheControlMaxAge="00:00:01" cacheControlMode="UseMaxAge" /&gt;
      &lt;/staticContent&gt;   
    &lt;/system.webServer&gt;
    &lt;runtime&gt;
      &lt;assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1"&gt;
        &lt;dependentAssembly&gt;
          &lt;assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35"/&gt;
          &lt;bindingRedirect oldVersion="1.0.0.0-2.0.0.0" newVersion="3.0.0.0"/&gt;
        &lt;/dependentAssembly&gt;
      &lt;/assemblyBinding&gt;
    &lt;/runtime&gt;
    &lt;system.serviceModel&gt;
      &lt;bindings&gt;
        &lt;basicHttpBinding&gt;
          &lt;binding name="BasicHttpBinding_ISuburbanService" maxReceivedMessageSize="128072" /&gt;
        &lt;/basicHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;client&gt;
        &lt;endpoint address="http://localhost:2181/ISuburbanService.svc"
          binding="basicHttpBinding" bindingConfiguration="BasicHttpBinding_ISuburbanService"
          contract="SuburbanService.ISuburbanService" name="BasicHttpBinding_ISuburbanService" /&gt;
      &lt;/client&gt;
      &lt;!--&lt;bindings&gt;
        &lt;basicHttpBinding&gt;
          &lt;binding name="BasicHttpBinding_ISuburbanService" closeTimeout="00:01:00"
            openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
            allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
            maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
            messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
            useDefaultWebProxy="true"&gt;
            &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
              maxBytesPerRead="4096" maxNameTableCharCount="16384" /&gt;
            &lt;security mode="Transport"&gt;
              &lt;transport clientCredentialType="Basic" proxyCredentialType="None"
                realm="" /&gt;
              &lt;message clientCredentialType="UserName" algorithmSuite="Default" /&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/basicHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;client&gt;
        &lt;endpoint address="https://localhost/SuburbanHUB/ISuburbanService.svc"
          binding="basicHttpBinding" bindingConfiguration="BasicHttpBinding_ISuburbanService"
          contract="SuburbanService.ISuburbanService" name="BasicHttpBinding_ISuburbanService" /&gt;
      &lt;/client&gt;--&gt;
      &lt;!--&lt;behaviors&gt;
        &lt;serviceBehaviors&gt;
          &lt;behavior name="SomeServiceServiceBehavior"&gt;
            &lt;serviceDebug includeExceptionDetailInFaults="true"/&gt;
            &lt;dataContractSerializer maxItemsInObjectGraph="2147483647"/&gt;
          &lt;/behavior&gt;
        &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;--&gt;
    &lt;/system.serviceModel&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>And the method that captures the post:</p>
  
  <pre><code>  [NoCache]
      [HttpPost]
      public ActionResult Receipt(string id)
      {
        var sb = new StringBuilder();
        try
        {
          sb.AppendLine("ActionResult Reciept(string account)");
  
          var count = 0;
          var postVals = new Dictionary&lt;string, string&gt;();
          foreach (var key in Request.Form.AllKeys)
          {
            sb.AppendLine("count: " + count);
            sb.AppendLine(string.Format("key:   {0}    Value:   {1}", key, Request.Form[key]));
            postVals.Add(key, Request.Form[key]);
            sb.AppendLine("finished count: " + count);
            count++;
          }
          sb.AppendLine("finished processing ALLKeys");
          var paymentReq = createPaymentRequest(postVals);
          sb.AppendLine("finished processing 'var paymentReq = createPaymentRequest(postVals)' ");
          var receipt = _client.RecordPaymentWithRequest(paymentReq);
  
          var retval = PartialView(receipt.Duplicate ? "Duplicate Receipt" : "Receipt", receipt);
          sb.AppendLine(string.Format("retval: {0}", retval));
          return retval;
  
        }
        catch (Exception ex)
        {
          sb.AppendLine(string.Format("Receipt error: {0}", ex.Message));
          Logging.LogException("Receipt error!", ex, _asName);
          throw;
        }
        finally
        {
          Logging.LogInfo(sb.ToString(), _asName);
        }
      }
  </code></pre>
  
  <p>As you can see above, I don't have <code>[Authorize]</code> on it so it shouldn't be requiring membership provider to check for access. The class level does not either.</p>
  
  <p>Anyone have any suggestions of what might be going on?</p>
  
  <p><strong>UPDATE</strong></p>
  
  <pre><code>2013-12-16 04:22:14 xxx.xxx.xxx.xxx GET /SuburbanCustPortal/Scripts/Views/logon.js - 443 - xxx.xxx.xxx.xxx Mozilla/5.0+(Linux;+Android+4.2.2;+en-us;+SAMSUNG+SGH-M919+Build/JDQ39)+AppleWebKit/535.19+(KHTML,+like+Gecko)+Version/1.0+Chrome/18.0.1025.308+Mobile+Safari/535.19 304 0 0 109
  2013-12-16 04:22:14 xxx.xxx.xxx.xxx GET /SuburbanCustPortal/Content/images/mod/modavoca.png - 443 - xxx.xxx.xxx.xxx Mozilla/5.0+(Linux;+Android+4.2.2;+en-us;+SAMSUNG+SGH-M919+Build/JDQ39)+AppleWebKit/535.19+(KHTML,+like+Gecko)+Version/1.0+Chrome/18.0.1025.308+Mobile+Safari/535.19 304 0 0 93
  2013-12-16 04:22:15 xxx.xxx.xxx.xxx GET /Content/favicon.ico - 443 - xxx.xxx.xxx.xxx Mozilla/5.0+(Linux;+Android+4.2.2;+en-us;+SAMSUNG+SGH-M919+Build/JDQ39)+AppleWebKit/535.19+(KHTML,+like+Gecko)+Version/1.0+Chrome/18.0.1025.308+Mobile+Safari/535.19 404 0 2 250
  2013-12-16 04:22:15 xxx.xxx.xxx.xxx GET /apple-touch-icon-precomposed.png - 443 - xxx.xxx.xxx.xxx Mozilla/5.0+(Linux;+Android+4.2.2;+en-us;+SAMSUNG+SGH-M919+Build/JDQ39)+AppleWebKit/535.19+(KHTML,+like+Gecko)+Version/1.0+Chrome/18.0.1025.308+Mobile+Safari/535.19 404 0 2 250
  2013-12-16 04:22:15 xxx.xxx.xxx.xxx GET /apple-touch-icon.png - 443 - xxx.xxx.xxx.xxx Mozilla/5.0+(Linux;+Android+4.2.2;+en-us;+SAMSUNG+SGH-M919+Build/JDQ39)+AppleWebKit/535.19+(KHTML,+like+Gecko)+Version/1.0+Chrome/18.0.1025.308+Mobile+Safari/535.19 404 0 2 78
  #Software: Microsoft Internet Information Services 7.0
  #Version: 1.0
  #Date: 2013-12-16 04:39:52
  #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken
  2013-12-16 04:39:52 xxx.xxx.xxx.xxx GET / - 443 - xxx.xxx.xxx.xxx - 200 0 0 171
  2013-12-16 04:50:12 xxx.xxx.xxx.xxx POST /SuburbanHUB/ISuburbanService.svc - 443 suburbansoftware xxx.xxx.xxx.xxx - 200 0 0 875
  2013-12-16 04:50:12 xxx.xxx.xxx.xxx POST /SuburbanHUB/ISuburbanService.svc - 443 suburbansoftware xxx.xxx.xxx.xxx - 200 0 0 187
  2013-12-16 04:50:12 xxx.xxx.xxx.xxx GET /SuburbanCustPortal/Account/Verify id=dde4bbfb-0d2e-4706-a604-36eea3fdcae3&amp;verifyid=c0b4fdb5-9bb3-4d2b-b724-df42e6ea2a59 443 - xxx.xxx.xxx.xxx Mozilla/5.0+(iPhone;+CPU+iPhone+OS+7_0_3+like+Mac+OS+X)+AppleWebKit/537.51.1+(KHTML,+like+Gecko)+Version/7.0+Mobile/11B511+Safari/9537.53 200 0 0 1328
  2013-12-16 04:50:12 xxx.xxx.xxx.xxx GET /SuburbanCustPortal/Content/reset.css - 443 - xxx.xxx.xxx.xxxMozilla/5.0+(iPhone;+CPU+iPhone+OS+7_0_3+like+Mac+OS+X)+AppleWebKit/537.51.1+(KHTML,+like+Gecko)+Version/7.0+Mobile/11B511+Safari/9537.53 200 0 0 453
  </code></pre>
  
  <p>There is a lapse in the log from 04:22:15 through 04:39:52</p>
  
  <p>Is this normal?</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>I clarified the steps above for those who asked.</p>