Hi,

I'm not sure what you're talking about. Your video does not show that you were able to login successfully with an incorrect username and password. It does show that you're redirected to the homepage after trying to login but you are not actually logged in.

I went to your site and tried to login but I could not so I don't think all logins are successful. Did you mean to say that all logins are not successful?

Thanks,
Joe

It seems like it is failing to set a login cookie or the login cookie is not being passed in the request headers between the web browser and the server.

For example if you have this web.config setting then the cookies will not be passed unless using https, with no authentication cookie it is the same as not being logged in.

<forms name=".mojochangeme" protection="All" timeout="129600" path="/" cookieless="UseCookies" requireSSL="true" />

requireSSL must only be true if you have an SSL certificate installed on the site and you must also have this setting in user.config:

<add key="SSLIsAvailable" value="true" />

Or if your site is hosted behind some kind of proxy server that is filtering the the request headers or using some kind of url forwarding for the host name it could cause a problem like that.

You can diagnose it further using a tool such as http fiddler to see what if any cookies are being passed in the request and response headers.

Hope that helps,

Joe