CODEWITHSUNDEEP
c#.netasp.net-mvcauthenticationforms-authentication
Brandon
Brandon

Reputation: 10953

ASP.NET - Redirect to Error Page if Roles Authorization Fails

I am using MVC 3 with Forms Authentication. On my controller or methods, I am doing the following:

[Authorize (Roles = "developer")]

In this situation, I want to check if the user is logged in and if not, return them to the login page. However, if the 'IsInRole' check for that user returns false, I want them to go to a different view that says something like 'Not authorized'.

What is the best way to accomplish something like this? I was hoping to avoid creating a new Authorization attribute so I didn't have to refactor every Authorize attribute in my entire application, but if that is what is required, I will go that route.

Upvotes: 23

Views: 21278

Answers (3)

hakantopuz
hakantopuz

Reputation: 511

You can use it like this.Because if you dont have authority it comes method. Authorization control is not necessary

protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
    {
        if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
        {
            // The user is not authenticated
            base.HandleUnauthorizedRequest(filterContext);
        }
        else
        {
            filterContext.Result = new ViewResult
            {
                ViewName = "~/Views/Shared/Unauthorized.cshtml",
            };
        }
    }

Upvotes: 1

TheCodeKing
TheCodeKing

Reputation: 19220

You can also do this with custom error page for 401 status codes.

See this question for implementation details.

Upvotes: 1

Darin Dimitrov
Darin Dimitrov

Reputation: 1038720

A custom authorize attribute overriding the HandleUnauthorizedRequest method could do the job:

public class MyAuthorizeAttribute : AuthorizeAttribute
{
    protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
    {
        if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
        {
            // The user is not authenticated
            base.HandleUnauthorizedRequest(filterContext);
        }
        else if (!this.Roles.Split(',').Any(filterContext.HttpContext.User.IsInRole))
        {
            // The user is not in any of the listed roles => 
            // show the unauthorized view
            filterContext.Result = new ViewResult
            {
                ViewName = "~/Views/Shared/Unauthorized.cshtml"
            };
        }
        else
        { 
            base.HandleUnauthorizedRequest(filterContext);
        }
    }
}

and then:

[MyAuthorize(Roles = "developer")]
public ActionResult Develop()
{
    ...
}

Upvotes: 51

Related Questions