Return HTTP 403 using Authorize attribute in ASP.Net Core

Question

When using ASP.Net WebAPI, I used to have a custom Authorize attribute I would use to return either an HTTP 403 or 401 depending on the situation. e.g. if the user is not authenticated, return a 401; if the user is authenticated but doesn't have the appropriate permissions, return a 403. See here for more discussion on that.

It seems now, in the new ASP.Net Core, they don't want you overriding the Authorize attribute anymore instead favoring a policy-based approach. However, it seems Core MVC suffers from the same "just return 401 for all auth errors" approach its predecessors have.

How do I override the framework to get the behavior I want?

Answer 1

I ended up doing it with middleware:

public class AuthorizeCorrectlyMiddleware {     readonly RequestDelegate next;      public AuthorizeCorrectlyMiddleware(RequestDelegate next)     {         this.next = next;     }      public async Task Invoke(HttpContext context)     {         await next(context);          if (context.Response.StatusCode == (int)HttpStatusCode.Unauthorized)         {             if (context.User.Identity.IsAuthenticated)             {                 //the user is authenticated, yet we are returning a 401                 //let's return a 403 instead                 context.Response.StatusCode = (int)HttpStatusCode.Forbidden;             }         }     } } 

which should be registered in Startup.Configure before calling app.UseMvc().