title: ASP.NET MVC Simple logon page, username & password match but getting unauthorized message
body: <p>I'm creating an application for school that has to be done using the MVC pattern. To begin with, I am trying to get a simple register and logon page up and running as if I can store and retrieve in my DB then the rest of the application should be fairly straightforward. I am using my University's sql server for my DB and using the ADO.NET entity data model (for the first time). </p>
  
  <p>I was using an online tutorial to help me and it all seemed to work well enough, but the trouble now is that when trying to log-on using details already in my table I get a 'Http 401.0 - Unauthorized' page.</p>
  
  <p>I know that what I'm entering in the email &amp; password box is matching what is being retrieved from the DB as I tested with labels and they all matched. I'm using ASP.NET 4.5.2 if that helps.</p>
  
  <p><a href="https://i.stack.imgur.com/K5t5r.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/K5t5r.jpg" alt="Unauthorized page"></a> </p>
  
  <p>My table is simple- </p>
  
  <pre><code>Email (pk)(varchar) - For logon
  Password (varchar) - For logon
  First_Name (varchar)
  </code></pre>
  
  <p>My code is as follows;</p>
  
  <p>UserLogon View - </p>
  
  <pre><code>public class UserLogon
  {    
      [Required]
      [Display(Name = "Email")]
      public string Email { get; set; }
  
      [Required]
      [DataType(DataType.Password)]
      [Display(Name = "Password")]
      public string Password { get; set; }
  }
  </code></pre>
  
  <p>User Manager View - </p>
  
  <pre><code>public class UserManager
  {
      private ac9555fEntities dre = new ac9555fEntities();
      public string GetUserPassword(string userEmail)
      {
          var user = from o in dre.UserTables where o.Email == userEmail  select o;
          if (user.ToList().Count &gt; 0)
              return user.First().Password;
          else
              return string.Empty;
      }
  }
  </code></pre>
  
  <p>Account Controller - </p>
  
  <pre><code>public class AccountController : Controller
  {
  
      public ActionResult LogOn()
      {
          return View();
      }
  
      //
      // POST: /Account/LogOn
  
      [HttpPost]
      public ActionResult LogOn(UserLogon model, string returnUrl)
      {
  
          if (ModelState.IsValid)
          {
  
              UserManager userManager = new UserManager();
              string password = userManager.GetUserPassword(model.Email);
  
  
              if (string.IsNullOrEmpty(password))
              {
  
                  ModelState.AddModelError("", "The user login or password provided is incorrect.");
              }
  
              if (password == model.Password)
              {
  
                  FormsAuthentication.SetAuthCookie(model.Email, false);
                  if (Url.IsLocalUrl(returnUrl) &amp;&amp; returnUrl.Length &gt; 1 &amp;&amp; returnUrl.StartsWith("/")
                      &amp;&amp; !returnUrl.StartsWith("//") &amp;&amp; !returnUrl.StartsWith("/\\"))
                  {
                      return Redirect(returnUrl);
                  }
                  else
                  {
                      return RedirectToAction("Welcome", "Home");
                  }
              }
              else
              {
                  ModelState.AddModelError("", "The password provided is incorrect.");
              }
          }
  
          // If we got this far, something failed, redisplay form
          return View(model);
      }
      }
  </code></pre>
  
  <p>Home Controller - </p>
  
  <pre><code>    public ActionResult Index()
      {         
          return View();
      }
  
      [Authorize]
      public ActionResult Welcome()
      {
          return View();
      }
  </code></pre>
  
  <p>LogOn View - </p>
  
  <pre><code>@model WebApplication5.Models.ViewModels.UserLogon
  ....
  @using (Html.BeginForm())
  {
      ....
      @Html.EditorFor(model =&gt; model.Email)
      ....
      @Html.EditorFor(model =&gt; model.Password)
      ....
      &lt;input type="submit" value="Log On" /&gt;
  }
  </code></pre>
  
  <p>I do apologize if I have included too much/not enough code, this is my first time using MVC/ADO.NET entity data model. From looking at other stuff on here and elsewhere on the web, I feel like there is an extra layer of authorization that isn't needed but any of the solutions I tried, failed to work. Can anyone spot where my code is flawed?</p>
  
  <pre><code>&lt;system.web&gt;
  &lt;compilation debug="true" targetFramework="4.5.2" /&gt;
  &lt;httpRuntime targetFramework="4.5.2" /&gt;
  &lt;/system.web&gt;
  </code></pre>