Hi Bob

Hm, not sure, it's a very simple script, basically just using standard membership functions. Did it stop working at the same time as something else was installed/changed?

Also - can you run ?umbdebugshowtrace=1 on the page and see if it says something on AUTH_USER or LOGON_USER ? 

both those values show as blank?

wierd... i will keep digging.

okay, so with the AWESOME help of Richard Soeteman [@rsoeteman on twitter send him a #H5YR] he pointed out that there could be an issue with a member NOT having an login name... still trying to figure out how that happened, but INDEED it DID happen...

Richard provided me with an update to the razor login script and said it was perfectly fine for me to share... so here it is...

@using System.Web  
@using System.Web.Security
@helper LoginForm()
{

}

@helper LogoutForm()
{

}

@helper Message(string message)
{

@message

}

@{
  var isSubmitLogin = (IsPost && Request["submit"]=="login");
  var isSubmitLogout = (IsPost && Request["submit"]=="logout");
  var currentUser = Membership.GetUser();
  var requestedUrl = Request.Url.PathAndQuery.ToString(); // Model.Url;
  if (Request["ReturnUrl"]!=null)
  {
    requestedUrl = Request["ReturnUrl"];
  }

  if (HttpContext.Current.User.Identity.IsAuthenticated)
   {    
    if (!isSubmitLogout)
     {
       @Message("Logged in : " + currentUser.UserName)
       @LogoutForm()
     }
    else
     {
       FormsAuthentication.SignOut();
       FormsAuthentication.RedirectToLoginPage();
     } 
   }

  if (!HttpContext.Current.User.Identity.IsAuthenticated)
   {
    if (!isSubmitLogin)  
     {
       @LoginForm()
      }
    else
     {
      string username=Request["username"];
      string password=Request["password"];
      if (Membership.ValidateUser(username, password))
      {
        // RedirectFromLoginPage does not work that good within the Umbraco context
        // FormsAuthentication.RedirectFromLoginPage(username, true);

        FormsAuthentication.SetAuthCookie(username, true);

        // Redirect to / refresh the requested page
        Response.Redirect(requestedUrl);
      }
      else
      {
        @Message("Login failed for " + username)
        @LoginForm()
      }
     }       
    }
  }

+1 for the HttpContext.Current.User.Identity.IsAuthenticated, I'll replace and update the package (some other code style tweaks too).

#h5yr to @rsoeteman :)

But wait - did the blank username make the user to be automatically logged in? That's strange.

it apparently made some 'member' logged in.... but you could not log them out... basically put authentication in a death loop...

is working on a reply...