Sitecore context user lost in custom MVC Route

Question

I'm having a strange issue with my Sitecore.Context.User. I set up a custom MVC route for a controller that looks like this

public class RouteConfig
{
    public static void RegisterRoutes(RouteCollection routes)
    {
        routes.MapRoute("accounts api", "accountsapi/{action}", new {controller = "Accounts", action = "{action}"});
    }
}

When I hit one of the controller actions using regular Sitecore MVC, the Sitecore.Context.User is authenticated and all my cookies etc. are present as I expected. However, if I access the same controller over the route that I have set up, the Sitecore.Context.User is the anonymous user (even when I'm already logged in) and I can see that I get a completely different set of cookies showing up (the auth cookie isn't 1 of them).

I first noticed the issue because I was attempting to authenticate over the route and noticed that the context was immediately lost when accessing the context via the normal sitecore routing process.

The routing is initialized via a pipeline like this

public class LoadCustomRoutes
{
    public void Process(PipelineArgs args)
    {
        Log.Info("Loading custom routes", this);
        RouteConfig.RegisterRoutes(RouteTable.Routes);
    }
}

Processor loaded like this:

<initialize>
    <processor type="ABC.Project.Common.Pipelines.LoadCustomRoutes, ABC.Project.Common" patch:after="processor[@type='Sitecore.Pipelines.Loader.EnsureAnonymousUsers, Sitecore.Kernel']" />
</initialize>

Is this expected behaviour? The AccountsController is a SitecoreController so it shouldn't be affected by any of the WebAPI drawbacks (as far as I know). I feel like I'm missing something but I'm not sure what it is. Any ideas?

Answer 1

So this was a classic case of chasing a red herring's shadow down a rabbit hole. The actual issue here had nothing to do with the custom route configuration. The authentication call was using the Fetch API to trigger the request. Upon further inspection, I noticed that the cookies were being returned in the response correctly, but were not being saved automatically. From the fetch docs:

By default, fetch won't send or receive any cookies from the server, resulting in unauthenticated requests if the site relies on maintaining a user session (to send cookies, the credentials init option must be set).

The fix for this was to add a credentials: 'include' property to the fetch call so that it saved cookies (even though the domain was the same).

fetch('/accountsapi/login', {
                    method: "post",
                    headers: {
                        "Accept": "application/json, text/plain, */*",
                        "Content-Type": "application/json"
                    },
                    credentials: 'include',
                    body: JSON.stringify(valueObj)
                })

Now things work like I would have expected... So nothing specific to sitecore on this one.