ASP.NET Unauthorized access on a controller should return 401 instead of 200 and the login page

Question

In an ASP.NET 5 Application I configured MVC and Identity framework like this:

app.UseMvc(config=>{
    config.MapRoute("Default", "{controller}/{action}/{id?}", new
            {
                controller = "Home",
                action = "Index"
            });
});

and adding Identity Services :

   services.AddAuthentication();
   services.AddAuthorization();

   services.AddIdentity<CrmUser, CrmUserRole>(config => { 
         config.User.RequireUniqueEmail = true;
          })
          .AddUserStore<MongoUserStore>()
          .AddRoleStore<MongoUserStore>()
          .AddDefaultTokenProviders();

and

 app.UseIdentity()
    .UseCookieAuthentication(i => { i.LoginPath = "/Account/Login";});

The example is defined as this:

public class MyApiController : Microsoft.AspNet.Mvc.Controller
{
    [Authorize]
    public async Task<ActionResult> Foo()
    {
        return Ok();
    }
}

This works fine, but i also have some controller which I want to use in a API way. In ASP.NET 5, they all have same base class so there is no difference between API and View Controllers.

As a result when calling an unauthorized api which requires authorization, I get an HTTP 200 and the Login page instead of an HTTP 401.

In a blog post by Shawn Wildermuth I found this

services.AddCookieAuthentication(config =>
    {
        config.LoginPath = "/Auth/Login";
        config.Events = new CookieAuthenticationEvents()
        {
            OnRedirect = ctx =>
            {
                if (ctx.Request.Path.StartsWithSegments("/api") &&
                ctx.Response.StatusCode == 200)
                {
                    ctx.Response.StatusCode =     (int)HttpStatusCode.Unauthorized;
                    return Task.FromResult<object>(null);
                }
                else
                {
                    ctx.Response.Redirect(ctx.RedirectUri);
                    return Task.FromResult<object>(null);
                }
            }
        };
    });

But should this really be the expected way to do this? For me this smells a little.

Answer 1

This issue has been fixed in RC1.

Check GitHub comment here: Issue

To upgrade to RC1, go to http://get.asp.net.

To be even more sure, you can also clear your %userprofile%\.dnx\ folder prior to getting the latest version.