Question

I am trying to create an access denied ActinoResult to return from my controllers. I have the following implementation

public class AccessDeniedResult : ActionResult
{
    public override void ExecuteResult(ControllerContext context)
    {
        if (null != context && null != context.HttpContext && null != context.HttpContext.Response)
        {
            context.HttpContext.Response.StatusCode = 401;
            context.HttpContext.Response.RedirectToRoute("AccessDenied");
        }
    }
}

This does not work because of a NotImplementedException coming from HttpResponseBase being passed as context.HttpContext.Response.

How do you write a correct redirecting action result in MVC3?

Answer 1

You should be returning HttpUnauthorizedResult like so:

return new HttpUnauthorizedResult();

Additionally, you should consider creating a new class deriving from AuthorizeAttribute to do security checks. You can then add this directive to your web.config to control where the client is directed:

<customErrors mode="On" defaultRedirect="~/Home/Error">
    <error statusCode="401" redirect="~/AccessDenied" />
</customErrors>

Finally, you can add a custom route to control what happens when the user is directed to ~/AccessDenied:

Route route = routes.MapRoute("AccessDeniedRoute", "AccessDenied", new { controller = "MyCustomErrorController", action = "My401Action" });
RouteTable.Routes.Add(route);