Question about [Authorize] Attribute for Administrators

If i have an Area in my ASP.NET MVC 3 (Razor) Web application, where all controllers derive from a base controller that looks like this:

[Authorize(Roles="Administrator")]
public class AdminController : Controller
{

}

When a non-administrator tries to access a URL in that area, they get redirected to the login page specified in the web.config.

But this doesn't really make开发者_如何学C sense if the user is already authenticated, but not an administrator. In that scenario, shouldn't we be returned a HTTP 401?

My question is basically how do people handle this - do they create custom authorize attributes?

---

See this thread ... ASP.Net converts 401 to 302 error codes

What you really want to do is return a 403 code. 401 is intended for authentication challenges. ASP.NET forms authorization intercepts 401 and pushes users to the login page.

If you still want to do a 401, could you describe what is the expected experience for the end user?

---

I work with ASP.NET MVC4 Beta and today I noticed that if I add ReturnUrl parameter to querystring, the forms module doesn't change the response.

So if action i/Rate has attribute [Authorize] then

<a href="/xm/i/Rate?pid=3&amp;count=2&amp;ReturnUrl=%2F">..</a>

returns 401. I don't know if it is bug, or feature, but now it works as described.

---

we have custom authorize filter attribute for such scenarios and we take user to custom error page

public void OnAuthorization(AuthorizationContext filterContext) {


if(//user does not have permission){

filterContext.Result = new RedirectResult("/Error/AccessDenied");

}

---

If an unauthorized user tries to access a method that is marked with the Authorize attribute, the MVC framework returns a 401 HTTP status code. If the site is configured to use ASP.NET forms authentication, the 401 status code causes the browser to redirect the user to the login page.

Refrence:http://msdn.microsoft.com/zh-tw/library/system.web.mvc.authorizeattribute.aspx

Other similar question: How to intercept 401 from Forms Authentication in ASP.NET MVC?