Question

I am trying to item-level security. I have a service like the following:

[DefaultView("Customer")]
public class CustomerService : MyServiceBase
{
    public object Get(CustomerRequest request)
    {
         if (UserIsAuthorizedForCustomer(request.Id))
         {
             return new CustomerResponse { Customer = GetCustomer(request.Id) };
         }
         else
         {
             return this.Redirect("/AccessDenied.htm");
         }
    }
}

The problem I’m having is that when the auth check fails and the service returns the redirect response, it seems like the razor page is still being executed, but with a null Model resulting in a NullReferenceException. Am I doing something wrong?

Thanks!

Answer 1

I’m not sure what your implementation of Redirect does, but the normal way to redirect to an error page is to just throw an exception which follows the redirection rules setup in your AppHost. e.g:

if (!UserIsAuthorizedForCustomer(request.Id))
    throw new UnauthorizedException("Not Authorized");

In your AppHost you can specify different redirection pages for different error codes, e.g:

SetConfig(new EndpointHostConfig {
    CustomHttpHandlers = {
        { HttpStatusCode.NotFound, new RazorHandler("/notfound") },
        { HttpStatusCode.Unauthorized, new RazorHandler("/login") },
    }
});

Or if you only want 1 page you can specify a fallback for unhandled errors:

SetConfig(new EndpointHostConfig {
    GlobalHtmlErrorHttpHandler = new RazorHandler("/error")
});