---
title: "Webmethod unAuthorized access"  
description: "Webmethod unAuthorized access"  
author: "Barbara Jones"  
published: 2014-11-25  
updated: 2014-11-26  
canonical: https://www.mindstick.com/forum/12690/webmethod-unauthorized-access  
category: "asp.net"  
tags: ["authentication", "authorization"]  
reading_time: 2 minutes  

---

# Webmethod unAuthorized access

I have implemented the new [ASP.NET](https://www.mindstick.com/articles/934/default-folders-available-inside-the-asp-dot-net-application-folder) [Identity](https://www.mindstick.com/articles/13090/icon-the-identity-of-your-brand) [model](https://yourviews.mindstick.com/view/81334/america-is-reopening-after-corona-lockdown-but-on-swedish-model) into my site. I can log in ok, but when I now try and call one of my WebMethods from [client](https://www.mindstick.com/articles/23198/3-steps-to-ensure-that-your-client-portal-is-impeccable) [script](https://www.mindstick.com/interview/477/how-can-i-execute-a-php-script-using-command-line), I get the following repsonse:

Do I need to do anything special to my WebMethod calls now?

**[Login](https://www.mindstick.com/articles/12852/styles-login-form-in-android) [code](https://yourviews.mindstick.com/view/85458/alan-turing-the-mastermind-behind-cracking-the-enigma-code-during-world-war-ii) is:**

```
    private const string AntiXsrfTokenKey = "__AntiXsrfToken";    private const string AntiXsrfUserNameKey = "__AntiXsrfUserName";    private string _antiXsrfTokenValue;     protected void Page_Init(object sender, EventArgs e)    {        // The code below helps to protect against XSRF attacks        var requestCookie = Request.Cookies[AntiXsrfTokenKey];        Guid requestCookieGuidValue;        if (requestCookie != null && Guid.TryParse(requestCookie.Value, out requestCookieGuidValue))        {            // Use the Anti-XSRF token from the cookie            _antiXsrfTokenValue = requestCookie.Value;            Page.ViewStateUserKey = _antiXsrfTokenValue;        }        else        {            // Generate a new Anti-XSRF token and save to the cookie            _antiXsrfTokenValue = Guid.NewGuid().ToString("N");            Page.ViewStateUserKey = _antiXsrfTokenValue;             var responseCookie = new HttpCookie(AntiXsrfTokenKey)            {                HttpOnly = true,                Value = _antiXsrfTokenValue            };            if (FormsAuthentication.RequireSSL && Request.IsSecureConnection)            {                responseCookie.Secure = true;            }            Response.Cookies.Set(responseCookie);        }         Page.PreLoad += Home_Page_PreLoad;    }     protected void Home_Page_PreLoad(object sender, EventArgs e)    {        if (!IsPostBack)        {            // Set Anti-XSRF token            ViewState[AntiXsrfTokenKey] = Page.ViewStateUserKey;            ViewState[AntiXsrfUserNameKey] = Context.User.Identity.Name ?? String.Empty;        }        else        {            // Validate the Anti-XSRF token            if ((string)ViewState[AntiXsrfTokenKey] != _antiXsrfTokenValue                || (string)ViewState[AntiXsrfUserNameKey] != (Context.User.Identity.Name ?? String.Empty))            {                throw new InvalidOperationException("Validation of Anti-XSRF token failed.");            }        }    }
```

and my [page load](https://www.mindstick.com/articles/12909/how-to-open-first-time-popup-on-page-load-in-website) looks like:

```
protected void Page_Load(object sender, EventArgs e)    {         if (!HttpContext.Current.User.Identity.IsAuthenticated)        {            //Redirect to Default page            Response.Redirect("~/Account/Login");        }         if (!IsPostBack)        {           ....        }    }
```

## Replies

### Reply by Anonymous User

Comment this AutoRedirectMode in routeconfig of app_start folder.

// settings.AutoRedirectMode = RedirectMode.Permanent;


---

Original Source: https://www.mindstick.com/forum/12690/webmethod-unauthorized-access

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.