asp.net - one controller action does not respond to AllowAnonymous -

i've come across odd authentication behaviour in mvc application. controllers inherit basecontroller, decorated [authorize] attribute. then, in login page, decorate actions [allowanoymous].

so, example, freely available whether user logged in or not.

[allowanonymous] public actionresult forgotpasswordconfirmation() {     return view(); } 

if remove [allowanonymous] attribute controller action , try , navigate it, sent login page, , see url automatically has returnurl parameter appened querystring.

however, have controller action same attribute:

[allowanonymous] public async task<actionresult> verifycode(string provider, string returnurl, bool rememberme) {     return view(new verifycodeviewmodel { provider = provider, returnurl = returnurl, rememberme = rememberme }); } 

my application absolutely not render view users aren't logged in, though it's decorated [allowanonymous]. can't life of figure out why. however, have noticed when try , navigate it, no returnurl gets generated.

i guess that's expected since it's supposed allow anonymous users. it's not. i've tried create skeleton controller action/view , without allowanonymous , works expected.

i'm not using filter or custom attribute. cause 1 action behave in such peculiar manner?

check if have call child action inside of verifycode.cshtml razor view, not allowed anonymous users.