asp.net mvc: TempData and AuthorizeAttribute

Question

As a followup to this question, I'm wondering what's happening to my TempData.

Scenario 1:

• user logs in
• user provides email address
• user receives email with validation code
• user clicks on validation url
• user is validated
• success msg is displayed via TempData set in Validate action

Scenario 2:

• user logs in
• user provides email address
• user logs out/times out
• user receives email with validation code
• user clicks on validation url
• user is validated
• success msg is not displayed via TempData set in Validate action

Now, I don't see a reason for the user to be logged in to validate. In Scenario 1, I put a "Success" message in TempData, and return RedirectToAction("Index"). Index action has an AuthorizeAttribute - if they're not logged in, they're redirected to the login screen (seperate controller).

I would like the login screen to display my message, but TempData appears to get cleared in this scenario. Am I misunderstanding the TempData lifecycle? Does it only apply to requests within the same controller?

Answer 1

The problem is that the AuthorizeAttribute is introducing another redirect into the cycle if the user is not logged in. You are redirecting the user to another action then, if the user is not logged in, the AuthorizeAttribute redirects them to the login page. TempData only lives over one request cycle, so the extra redirect (request) is emptying it and it isn't available on the login page.

You might consider just putting it in the Session directly instead of the TempData front-end to the Session. It should still be there as long as the Session lives.