I'm having a strange issue with my Sitecore.Context.User. I set up a custom MVC route for a controller that looks like this

public class RouteConfig
    public static void RegisterRoutes(RouteCollection routes)
        routes.MapRoute("accounts api", "accountsapi/{action}", new {controller = "Accounts", action = "{action}"});

When I hit one of the controller actions using regular Sitecore MVC, the Sitecore.Context.User is authenticated and all my cookies etc. are present as I expected. However, if I access the same controller over the route that I have set up, the Sitecore.Context.User is the anonymous user (even when I'm already logged in) and I can see that I get a completely different set of cookies showing up (the auth cookie isn't 1 of them).

I first noticed the issue because I was attempting to authenticate over the route and noticed that the context was immediately lost when accessing the context via the normal sitecore routing process.

The routing is initialized via a pipeline like this

public class LoadCustomRoutes
    public void Process(PipelineArgs args)
        Log.Info("Loading custom routes", this);

Processor loaded like this:

    <processor type="ABC.Project.Common.Pipelines.LoadCustomRoutes, ABC.Project.Common" patch:after="processor[@type='Sitecore.Pipelines.Loader.EnsureAnonymousUsers, Sitecore.Kernel']" />

Is this expected behaviour? The AccountsController is a SitecoreController so it shouldn't be affected by any of the WebAPI drawbacks (as far as I know). I feel like I'm missing something but I'm not sure what it is. Any ideas?

  • Is you API url and site url the same?
    – Chris Auer
    Commented Aug 30, 2017 at 15:14
  • Yes it is the same domain
    – Rondel
    Commented Aug 30, 2017 at 15:45
  • Can you try using a controller as your base instead of Sitecore controller. I never use the Sitecore controller class and it works for me. Do you use the Sitecore initialize class to register your mvc routes?
    – Chris Auer
    Commented Aug 30, 2017 at 16:43
  • 1
    How do you test your api request? Is it a call from javascript? Different cookies almost looks like some custom way of sending the request to the api Commented Aug 31, 2017 at 9:10
  • 1
    @ChrisvandeSteeg It did turn out to be an issue in the JS where it wasn't sending or accepting cookies. sigh Lesson learned though
    – Rondel
    Commented Aug 31, 2017 at 13:35

1 Answer 1


So this was a classic case of chasing a red herring's shadow down a rabbit hole. The actual issue here had nothing to do with the custom route configuration. The authentication call was using the Fetch API to trigger the request. Upon further inspection, I noticed that the cookies were being returned in the response correctly, but were not being saved automatically. From the fetch docs:

By default, fetch won't send or receive any cookies from the server, resulting in unauthenticated requests if the site relies on maintaining a user session (to send cookies, the credentials init option must be set).

The fix for this was to add a credentials: 'include' property to the fetch call so that it saved cookies (even though the domain was the same).

fetch('/accountsapi/login', {
                    method: "post",
                    headers: {
                        "Accept": "application/json, text/plain, */*",
                        "Content-Type": "application/json"
                    credentials: 'include',
                    body: JSON.stringify(valueObj)

Now things work like I would have expected... So nothing specific to sitecore on this one.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.