c# - MVC Customized Authentication filter not working as expected -

i have 4 controllers namely account, admin, home , gallery. out of 4 controllers need authorize admin controller , remaining can have access anonymous. i've decorated home controller, gallery controller , account controller [allowanonymous] attribute , i've admin controller decorated custom authorization filter named [custauthfilter] , contains following code.

public class custauthfilter : authorizeattribute {     protected override bool authorizecore(httpcontextbase httpcontext)     {       var request = httpcontext.request;       string controller = request.requestcontext.routedata.values["controller"].tostring().tolower();       if (controller != "" && controller == "admin")       {           var isauthorized = base.authorizecore(httpcontext);           if (!isauthorized)           {                 return false;           }           else           {                 if (!object.referenceequals(httpcontext.session["un"], null))                 {                       return true;                 }                 else                 {                       return false;                 }            }        }        else        {           return true;        }      }       override public void onauthorization(authorizationcontext filtercontext)      {            base.onauthorization(filtercontext);            if (filtercontext.result httpunauthorizedresult && filtercontext.httpcontext.request.isajaxrequest())            {                string url = system.web.security.formsauthentication.loginurl + "?x-requested-with=xmlhttprequest";                 filtercontext.result = new redirectresult(url);            }      }       protected override void handleunauthorizedrequest(authorizationcontext filtercontext)      {         string url = system.web.security.formsauthentication.loginurl;         filtercontext.result = new redirectresult(url);      } } 

and in web.config i've following

<authentication mode="forms">       <forms loginurl="~/account/login" defaulturl="~/admin/index" timeout="2880" protection="encryption" slidingexpiration="true" cookieless="autodetect"/> </authentication> <authorization>    <deny users="?"/> </authorization> 

and have registered customized authorization attribute in filters follows:

filters.add(new custauthfilter()); 

but whenever try access domainname/home or domainname/gallery automatically redirected domainname/account/login. don't have idea why after decorating home , gallery controller [allowanonymous] redirecting account controller!!

the behavior happening because of authorization config i.e.

<authorization>     <deny users="?"/> </authorization> 

remove line config , should working after that.

you trying mix authorization in web.config , authorize attribute available in mvc. read link on clear answer not using authorization tag authorize attribute vs authorization node in web.config