How do I configure what happens when using the Authorize (Roles) attribute?

Question

I have an MVC4 project with simplemembership setup. All this works, etc., but I would like to know how to tell him that the controller / action is redirected when the user does not have the right to view this page.

For example, if I use [Authorize(Roles="Admin")] and try to view this page with a registered user who does not have the "Admin" role, it redirects me to the login page, although I have already logged in.

I would like to change this to something else ... maybe 404 or a good message to say, "You do not have permission to view this content."

I tried a google search for everything I can think of to do this, but have not yet found an answer.

Can this be done with the current setup or do I need something else? A pointer in the right direction would be appreciated :)

Answer 1

Try creating your own AuthrorizeAttribute and overriding OnAuthorization so that you redirect to your page if authorization fails and the login page if authentication fails. Another approach that some people take is to authenticate the current user on the login page, and if so, you can assume that they were redirected to this page because the authorization failed. In this case, display a special message to the user indicating that they do not have permission to access this page. For some applications, this may make sense, because the user may have several accounts, and they want to log in to another account where they are authorized to perform this operation. Some of these concepts are discussed in this QA .

Answer 2

This is unfortunately a problem with Asp.net as a whole (although it comes from a problem in the HTTP specification), it does not distinguish between unauthorized users and unauthenticated users, although they seem to go out of their way to talk about the difference. To change this behavior, you will need to write a lot of code, and the easiest way to write your own handler is to check if you have already passed the authentication.

The HTTP standard is never intended to be in an “authenticated state”. In fact, he does not even know about the concept of "user". Each page request is designed to transfer information independent of other page requests. The fact that browsers cache this information (or authentication is done by cookies) is not related to what was provided by the standard.

The standard basically says that the server should release 401 if the requested resource is not authorized, and since each request has its own authorization, a simple pass / fail scenario is outlined. There is no concept of an authorized state on the site. The request either succeeds or does not work.

I think frameworks like ASP.NET have come a long way toward creating their own authorization and authentication state, but they really should just go all the way here.

You can find this thread highlighting the disagreement between the web community regarding accurate interpretations.

403 Forbidden vs 401 Unauthorized HTTP responses