ASP.Net MVC Authorisation action filter

Question

I'm trying to understand how error handling works when using the Authorize [Authorize] Action Filter in MVC Preview 4.

I have an action that looks like this:

[Authorize(Roles = "DOMAIN\\NOTAUTHORISED_ROLE" )]
[HandleError]
public ActionResult NeedAuthorisation()
{
    throw new NotImplementedException();
}

When I visit the url: http://localhost:2197/testAuthorisation/NeedAuthorisation, I get a blank page in my browser. In Firebug I can see that a request was made and a response-status of 401 - Unauthorised has been returned. But I'm not being redirected or having a customError returned. Everything works as expected when using a role that I'm authorized for.

This is using Windows authentication. I'm in the middle of writing some code to try out Forms authentication to see if I get the same issue. I have <customerrors mode="On"/> set and have created error pages, both in the testAuthorisation folder and the Shared folder.

Answer 1

I eventually found this MVC tutorial which solved my problem:

Exactly what happens when you attempt to invoke a controller action without being the right permissions depends on the type of authentication enabled. By default, when using the ASP.NET Development Server, you simply get a blank page. The page is served with a 401 Not Authorized HTTP Response Status.