AbleCommerce Shopping Cart Software

Hi,

I'm having an issue where a user is asked to log in occasionally upon clicking on a category or product detail page. Those pages are both custom. I'm also using a custom Url Rewriter. If they back out and try again, it works, so the log in isn't actually required. The URL they're redirected to when being asked to log in is like this: http://site.com/login.aspx?ReturnUrl=/P ... goryId=197

Is it related to the Url Rewriter, or something else?

It may because you may be using some custom redirect to some secure pages in certain cases. In our out of the box package both category and product details pages are public and doesn't require any login.

*Note that I work with kyledr, so this is for the same issue.

I believe I have this tracked down to something to do with having anonymous authentication disabled and windows authentication enabled.
This is on a server running windows server 2008, IIS7. We lock down our development sites with windows authentication so they aren't open to anyone.

After entering your windows authentication:
If you go to the root url, http://projectorpoint.catalyststudios.com, some of the requests to ScriptResource.axd will be redirected to the login page. If you reload the page, everything loads fine.
Alternatively if you link somewhere else in the site, /AboutUs.aspx, /C/326/Projectors.aspx, etc. you will end up redirected to the login page. If you try to go to the same url again it will load fine.

Looking at what is occurring with firebug or fiddler, there is a request made to the original page, say /AboutUs.aspx, this gets a 302 moved and is then redirected to the login page, the login page gets a 401 and the windows authentication pops up.
If we do the same thing with one of our non-AbleCommerce development sites the windows authentication pops up and there is no 302 moved/redirect.
I can reliably recreate this by closing the browser, opening a new browser and making another request.

On other occasions we will get a 302 for every page request, and constantly redirected to the login page. This hasn't occurred very often and I haven't been able to figure out how to replicate the issue.
Although just now I've discovered if I try to hit the site not at the root, using firefox 3.0.19, then even after logging in with the windows authentication I get a login page request for every link I hit. If I go to the root instead, it doesn't give me the login page. So that issue may be specific to only some browsers.

Because the live site wouldn't have windows authentication we may just deal with this, or lock down the site some other way besides windows authentication.