title: Auto-redirect not working after user authentication
body: <p>My team and I are starting up a new website project in ASP .NET 5 and I'm trying to set up the basis of our user authentication and authorization policy.</p>
  
  <p>I am currently toying with cookie-based authentication for returning users, so I've added the following to the Configure method of my Startup.cs:</p>
  
  <pre><code>        // Redirect to login page if user is not logged in.
          app.UseCookieAuthentication(options =&gt;
          {
              options.AutomaticAuthentication = true;
              options.ExpireTimeSpan = new System.TimeSpan(0, 1, 0);
              options.SlidingExpiration = true;
              options.LoginPath = "/Login";
              options.ReturnUrlParameter = "ReturnUrl";
          });
  </code></pre>
  
  <p>The authentication service is also added to the ConfigureServices method.</p>
  
  <p>My concern is with the LoginPath parameter: while automatic redirection to the Login page works correctly when my middleware/filter (I tried both) returns a 401 code, automatic redirection back from the login page to the one that was originally requested doesn't work: the browser remains on the login page even after a successful login.</p>
  
  <p>I strongly suspect the problem lies somewhere within my controller. Here is its (slightly simplified) source code:</p>
  
  <pre><code>[Route("[controller]")]
  [AllowAnonymous]
  public class LoginController : Controller
  {
      private static readonly string AuthenticationScheme = CookieAuthenticationDefaults.AuthenticationScheme;
  
      public IActionResult Index()
      {
          return View();
      }
  
      [HttpPost]
      public async System.Threading.Tasks.Task&lt;ActionResult&gt; Post(LoginInfo infos)
      {
          if (ValidateLogin(infos))
          {
              await Context.Authentication.SignInAsync(AuthenticationScheme, new ClaimsPrincipal(new ClaimsIdentity(new List&lt;Claim&gt;
              {
                  new Claim(ClaimTypes.Role, "Admin")
              }, 
              AuthenticationScheme)));
          }
  
          return View("Index");
      }
  
      private static bool ValidateLogin(LoginInfo infos)
      {
          return infos.Username == "abc" &amp;&amp; infos.Password == "def";
      }
  }
  </code></pre>
  
  <p>(bits of code removed for clarity, e.g. displaying an error message if the username/pwd combination is rejected)</p>
  
  <p>The view is very simple and contains a simple form providing a couple of edit boxes and POST-ing the user/password to the controller (again, error message removed for clarity):</p>
  
  <pre><code>@using (Html.BeginForm("Post", "Login", FormMethod.Post))
  {
      &lt;div&gt;
          &lt;h2&gt;Login Page&lt;/h2&gt;
          &lt;p&gt;
              @Html.Label("Username")
              @Html.Editor("Username")
          &lt;/p&gt;
  
          &lt;p&gt;
              @Html.Label("Password")
              @Html.Password("Password")
          &lt;/p&gt;
  
          &lt;p&gt;
              &lt;input type="submit" value="Attempt login" /&gt;
          &lt;/p&gt;
      &lt;/div&gt;
  }
  </code></pre>
  
  <p>I've been able to check that user sign-in works correctly by fetching user identity and claims in a separate controller. Initial redirection to the login page also works correctly (i.e. I get redirected to '/Login' when I try to access protected parts of the website without logging in), and the redirected URL correctly contains a ReturnUrl query parameter. I have also tried accessing the Referer URL while handling the Post action and managed to forcefully trigger redirection by manually returning a RedirectResult from the controller, so the contents of the ReturnUrl themselves must be good too.</p>
  
  <p>So... can anyone help me understand why redirection to the return URL is not performed automatically?</p>
  
  <p>edit: according to the documentation of CookieAuthenticationOptions.LoginPath:</p>
  
  <blockquote>
    <p>Summary:
        The LoginPath property informs the middleware that it should change an outgoing
        401 Unauthorized status code into a 302 redirection onto the given login path.
        The current url which generated the 401 is added to the LoginPath as a query
        string parameter named by the ReturnUrlParameter. <strong>Once a request to the LoginPath
        grants a new SignIn identity, the ReturnUrlParameter value is used to redirect
        the browser back to the url which caused the original unauthorized status code.</strong>
        If the LoginPath is null or empty, the middleware will not look for 401 Unauthorized
        status codes, and it will not redirect automatically when a login occurs.</p>
  </blockquote>
  
  <p>The part in bold is the one I'm trying to leverage... redirecting to a static page (i.e. manually returning a Redirect() to some hardcoded page) is not what I'm trying to accomplish here.</p>