New Asp.Net MVC5 project produces an infinite loop to login page

Question

I am creating a brand new projet with Visual Studio 2013, I choose Asp.Net MVC and the framework 4.5.1 The project is created, then, I do nothing else than F5 to start the default web page. Unfortunately, it produces a redirect to the login page which is redirecting into the login page too. Here is a short version of the url I have in the browser:

http://localhost:5285/Account/Login?ReturnUrl=%2FAccount%2FLogin%3FReturnUrl%3D%252FAccount%252FLogin%253FReturnUrl%253D%25252FAccount%25252FLogin%25253FReturnUrl%25253D%2525252FAccount%2525252FLogin%2525253FReturnUrl%2525253D%252525252FAccount%252525252FLogin%252525253FReturnUrl%252525253D%25252525252FAccount%25252525252FLogin%25252525253FReturnUrl%25252525253D%2525252525252FAccount%2525252525252FLogin%2525252525253FReturnUrl%2525252525253D%252525252525

I do not have any error in the Event Viewer. But in the screen I see :

"HTTP Error 404.15 - Not Found The request filtering module is configured to deny a request where the query string is too long."

The website is running with the default setting in IIS Express. How can I fix this problem? I am guessing something is wrong with my Visual Studio 2013?

Edit

It works if I create a brand new website and I host it in IIS. But if I create a new website (without modifying anything) and just hit play (which start IIS Express by default), it doesn't.

Edit 2

I have deleted every websites in the Documents\IISExpress\config\applicationhost.config. I have recompiled everything, and it created this entry :

    <siteDefaults>
        <logFile logFormat="W3C" directory="%IIS_USER_HOME%\Logs" />
        <traceFailedRequestsLogging directory="%IIS_USER_HOME%\TraceLogFiles" enabled="true" maxLogFileSizeKB="1024" />
    </siteDefaults>
    <applicationDefaults applicationPool="Clr4IntegratedAppPool" />
    <virtualDirectoryDefaults allowSubDirConfig="true" />
</sites>

I am still getting the error with IIS Express, not with IIS.

Answer 1

Highlight the project in Visual Studio

Open the 'Properties' panel on the right (or press F4)

Set 'Windows Authentication' to 'Disabled'

Set 'Anonymous Authentication' to 'Enabled'

Answer 2

You are missing [AllowAnonymous] attribute on login action.

[AllowAnonymous]
public ActionResult Login(string returnUrl)
{
    // code....
}

2nd possibility, specific to IIS Express only: is that, if you created same default WebApplication1 project multiple times, playing with different authentication settings, IIS Express stored additional authentication settings in it's configuration file. Something like:

    <location path="WebApplication1">
        <system.webServer>
            <security>
                <authentication>
                    <windowsAuthentication enabled="true" />
                    <anonymousAuthentication enabled="false" />
                </authentication>
            </security>
        </system.webServer>
    </location>
</configuration>

Configurations are in user's Documents folder Documents\IISExpress\config\, and you should look for:

applicationhost.config

Then just delete xml node <location path="WebApplication1"> mentioned above.

---

Update for VS 2015+

If you're using Visual Studio 2015 or higher, check this path for the config file: $(solutionDir)\.vs\config\applicationhost.config

Each solution will have its own config file.

Answer 3

This issue is because of the authentication mode selected(by default) by the MVC 5 Template, which triggers the ReturnUrl Style of redirection that might lead to an infinite loop if not configured correctly.

To disable OWIN startup discovery,add this key to your webconfig file.

<add key="owin:AutomaticAppStartup" value="false"/>