ASP.NET MVC 4 custom Authorize attribute - How to redirect unauthorized users to error page? [duplicate]

Question

I'm using a custom authorize attribute to authorize users' access based on their permission levels. I need to redirect unauthorized users (eg. user tries to delete an invoice without Delete acess level) to access denied page.

The custom attribute is working. But in a case of unauthorized user access, nothing shown in the browser.

Contoller Code.

public class InvoiceController : Controller {     [AuthorizeUser(AccessLevel = "Create")]     public ActionResult CreateNewInvoice()     {         //...          return View();     }      [AuthorizeUser(AccessLevel = "Delete")]     public ActionResult DeleteInvoice(...)     {         //...          return View();     }      // more codes/ methods etc. } 

Custom Attribute class code.

public class AuthorizeUserAttribute : AuthorizeAttribute {     // Custom property     public string AccessLevel { get; set; }      protected override bool AuthorizeCore(HttpContextBase httpContext)     {         var isAuthorized = base.AuthorizeCore(httpContext);         if (!isAuthorized)         {                             return false;         }          string privilegeLevels = string.Join("", GetUserRights(httpContext.User.Identity.Name.ToString())); // Call another method to get rights of the user from DB          if (privilegeLevels.Contains(this.AccessLevel))         {             return true;         }         else         {             return false;         }                 } } 

Appreciate if you can share your experience on this.

Answer 1

You have to override the HandleUnauthorizedRequest as specified here.

public class CustomAuthorize: AuthorizeAttribute {     protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)     {         if(!filterContext.HttpContext.User.Identity.IsAuthenticated)         {             base.HandleUnauthorizedRequest(filterContext);         }         else         {             filterContext.Result = new RedirectToRouteResult(new             RouteValueDictionary(new{ controller = "Error", action = "AccessDenied" }));         }     } } 

**Note: updated conditional statement Jan '16