title: Why is Hangfire requiring authentication to view dashboard
body: <p>I am running HangFire within my MVC web app but whenever I try to navigate to <a href="http://MyApp/hangfire">http://MyApp/hangfire</a>, it redirects me to my app's login page as though I am not logged in.</p>
  
  <p>I have not explicitly configured any requirements for authorization...e.g. I had the below in the web.config, but then took it out in attempts to get this to work.</p>
  
  <pre><code>&lt;location path="hangfire"&gt;
  &lt;system.web&gt;
    &lt;authorization&gt;
      &lt;allow roles="Administrator" /&gt;
      &lt;deny users="*" /&gt;  
    &lt;/authorization&gt;
  &lt;/system.web&gt;
  </code></pre>
  
  <p></p>
  
  <p>In theory, this is what I'd want, and when I log into my main web application, I will be logged in with an <code>Administrator</code> role so this rule should work.</p>
  
  <p>But whether I have that configured in the web.config or not, whenever I try to navigate to <a href="http://MyApp/hangfire">http://MyApp/hangfire</a>, it redirects me to my apps login page as configured in the web.config:</p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
    &lt;forms loginUrl="~/Account/Login" timeout="960" /&gt;
  &lt;/authentication&gt;
  </code></pre>
  
  <p>It does NOT do this on my local machine, just when I publish to my host. Does HangFire not recognize the authentication cookie that my main app provides when I login? I thought in general, the hangfire app doesn't require authentication, so what other configuration could be thinking that it does?</p>
  
  <p><strong>UPDATE 1:</strong></p>
  
  <p>I added the authorization filters per the <a href="http://docs.hangfire.io/en/latest/configuration/configuring-authorization.html">hangfire docs</a>, but the same thing happens. Here is my code in Startup.cs:</p>
  
  <pre><code>using Hangfire;
  using Hangfire.Logging;
  using Hangfire.Dashboard;
  using Hangfire.SqlServer;
  using Microsoft.Owin;
  using OTIS.Web.AppCode;
  using OTISScheduler.AppServ;
  using Owin;
  using System.Web.Security;
  
  [assembly: OwinStartup(typeof(OTIS.Web.App_Start.Startup))]
  namespace OTIS.Web.App_Start
  {
      public class Startup
      {
          public void Configuration(IAppBuilder app) {
  
              app.UseHangfire(config =&gt; {
                  config.UseSqlServerStorage("DefaultConnection");
                  config.UseServer();
  
                  //Dashboard authorization
                  config.UseAuthorizationFilters(new AuthorizationFilter
                  {
                      Users = "USERA", // allow only specified users (comma delimited list)
                      Roles = "Account Administrator, Administrator" // allow only specified roles(comma delimited list)
                  });
  
  
              });
  
              LogProvider.SetCurrentLogProvider(new StubLogProviderForHangfire());
  
              GlobalJobFilters.Filters.Add(new AutomaticRetryAttribute { Attempts = 0 });
  
              var scheduleTasksInitializer = new ScheduleTasksInitializer();
  
              scheduleTasksInitializer.ScheduleTasks();
          }
      }
  }
  </code></pre>
  
  <p>UPDATE 2:</p>
  
  <p>Per the more <a href="https://github.com/HangfireIO/Hangfire.Dashboard.Authorization">detailed instructions showing basic authentication</a>, I also tried this...still no luck..redirects me to my app's login page.</p>
  
  <pre><code>config.UseAuthorizationFilters(
  new BasicAuthAuthorizationFilter(
      new BasicAuthAuthorizationFilterOptions
      {
          // Require secure connection for dashboard
          RequireSsl = false,
          SslRedirect = false,
  
          // Case sensitive login checking
          LoginCaseSensitive = true,
  
          // Users
          Users = new[]
          {
              new BasicAuthAuthorizationUser
              {
                  Login = "MyLogin",
  
                  // Password as plain text
                  PasswordClear = "MyPwd"
              }
          }
      }));          
  </code></pre>