One issue that I have had for a while that I think I finally solved was what to do with unauthorized jQuery Ajax requests in my ASP.NET MVC application. I finally wrote a custom authorization attribute to take care of the situation.
I ran into two issues while constructing the attribute; the first was the need to send back different responses depending upon the content type of the request. The second was that the ASP.NET framework intercepts 401’s no matter what you do with your web config. You can see in the code below how I addressed these two issues.
Code Snippet
- public class CustomAuthorizeAttribute : AuthorizeAttribute
- {
- public override void OnAuthorization(AuthorizationContext filterContext)
- {
- base.OnAuthorization(filterContext);
- if (filterContext.Result == null || (filterContext.Result.GetType() != typeof(HttpUnauthorizedResult)
- || !filterContext.HttpContext.Request.IsAjaxRequest()))
- return;
-
- var redirectToUrl = "/login?returnUrl=" + filterContext.HttpContext.Request.UrlReferrer.PathAndQuery;
-
- filterContext.Result = filterContext.HttpContext.Request.ContentType == "application/json"
- ? (ActionResult)
- new JsonResult
- {
- Data = new { RedirectTo = redirectToUrl },
- ContentEncoding = System.Text.Encoding.UTF8,
- JsonRequestBehavior = JsonRequestBehavior.DenyGet
- }
- : new ContentResult
- {
- Content = redirectToUrl,
- ContentEncoding = System.Text.Encoding.UTF8,
- ContentType = "text/html"
- };
-
- //Important: Cannot set 401 as asp.net intercepts and returns login page
- //so instead set 530 User access denied
- filterContext.HttpContext.Response.StatusCode = 530; //User Access Denied
- filterContext.HttpContext.Response.TrySkipIisCustomErrors = true;
- }
- }
Note: The idea to send a different status code is from a comment that Craig Stuntz made on this Stackoverflow post.
Then on the client side, my default jQuery Ajax setup has a check in the error handling to look for the 530 status code and if found it resets the window’s location as needed.
What would you do different or what did I not think of?
Subscribe