title: ASP.NET Core - Authorize attribute doesn't force redirect to login page
body: <p>I have setup a new asp.NET Core web project. I want to have custom authentication, where I create my own cookie and assign claims to the user.  This was fairly straight forward to setup.</p>
  <p>My Startup.cs code looks like this:</p>
  <pre><code>public class Startup
  {
      public Startup(IHostingEnvironment env)
      {
          var builder = new ConfigurationBuilder()
              .SetBasePath(env.ContentRootPath)
              .AddJsonFile(&quot;appsettings.json&quot;, optional: true, reloadOnChange: true)
              .AddJsonFile($&quot;appsettings.{env.EnvironmentName}.json&quot;, optional: true)
              .AddEnvironmentVariables();
          Configuration = builder.Build();
      }
  
      public IConfigurationRoot Configuration { get; }
  
      public void ConfigureServices(IServiceCollection services)
      {
          // Add framework services.
          services.AddMvc();
  
          services.Configure&lt;CookieAuthenticationOptions&gt;(options =&gt;
          {
              options.LoginPath = new PathString(&quot;/account/login&quot;);
              options.AccessDeniedPath = new PathString(&quot;/account/accessdenied&quot;);
              options.AutomaticChallenge = true;
          });
  
          services.AddAuthorization(options =&gt;
          {
             options.AddPolicy(&quot;AdminOnly&quot;, policy =&gt; {  
                 policy.RequireClaim(ClaimTypes.Role, &quot;admin&quot;); });
             });
          }
      
          public void Configure(IApplicationBuilder app, 
                                IHostingEnvironment env, ILoggerFactory loggerFactory)
          {
  
          loggerFactory.AddConsole(Configuration.GetSection(&quot;Logging&quot;));
          loggerFactory.AddDebug();
  
          app.UseStaticFiles();
  
          app.UseCookieAuthentication(new CookieAuthenticationOptions
          {
              LoginPath = new PathString(&quot;/account/login&quot;),
              AccessDeniedPath = new PathString(&quot;/account/accessdenied&quot;),
              AutomaticChallenge = true
          });
  
          app.UseMvcWithDefaultRoute();
      }
  }
  </code></pre>
  <p>I then set the following logon method:</p>
  <pre><code>[HttpPost]
  public async Task&lt;IActionResult&gt; Login(string userName, 
             string password, string returnUrl = null)
  {
          ViewData[&quot;ReturnUrl&quot;] = returnUrl;
  
          if (!string.IsNullOrEmpty(userName) &amp;&amp; userName == password)
          {
              List&lt;Claim&gt; claims;
  
              switch (userName)
              {
  
                  case &quot;admin&quot;:
                      claims = new List&lt;Claim&gt;
                      {
                          new Claim(&quot;sub&quot;, &quot;2&quot;),
                          new Claim(&quot;name&quot;, &quot;Bob&quot;),
                          new Claim(&quot;email&quot;, &quot;bob@smith.com&quot;),
                          new Claim(&quot;status&quot;, &quot;junior&quot;),
                          new Claim(&quot;department&quot;, &quot;sales&quot;),
                          new Claim(&quot;region&quot;, &quot;north&quot;),
                          new Claim(&quot;role&quot;, &quot;supervisor&quot;),
                          new Claim(ClaimTypes.Role, &quot;admin&quot;)
                      };
                      break;
                      
                  default:
                      claims = new List&lt;Claim&gt;
                      {
                          new Claim(&quot;sub&quot;, &quot;3&quot;),
                          new Claim(&quot;name&quot;, userName),
                          new Claim(&quot;email&quot;, userName + &quot;@smith.com&quot;),
                          new Claim(&quot;status&quot;, &quot;intern&quot;),
                          new Claim(&quot;department&quot;, &quot;development&quot;),
                          new Claim(ClaimTypes.Role, &quot;client&quot;)
                      };
                      break;
              }
  
              var id = new ClaimsIdentity(claims, &quot;local&quot;);//, &quot;local&quot;, &quot;name&quot;, &quot;role&quot;
                      await HttpContext.Authentication.SignInAsync(&quot;Cookies&quot;, 
                  new ClaimsPrincipal(id));
      
              return LocalRedirect(&quot;/Home/Index&quot;);
          }
          return View();
      }
  </code></pre>
  <p>All works fine, and putting the [Authorize] attribute on any of the controller methods, stops access unless you are logged in, like so:</p>
  <pre><code>    [Authorize]
      public IActionResult AccessibleToLoggedIn()
      {
          ViewData[&quot;Message&quot;] = &quot;Example - open to any logged in user!&quot;;
          return View();
      }
  
      [Authorize(Policy =&quot;AdminOnly&quot;)]
      public IActionResult AdminPage()
      {
          ViewData[&quot;Message&quot;] = &quot;Admin only page&quot;;
          return View();
      }
  </code></pre>
  <p>All sounds good so far...</p>
  <p>One thing I'm struggling to get working - when a user attempts to access the view with the [Authorize] attribute attached, they don't get redirected to the login page.</p>
  <p>What am I doing wrong?</p>
  <p>I would also like to be able to redirect a user to an access denied page later on, when they don't match a particular policy I intend to define.</p>
  <p>Thanks in advance for any pointers!</p>