Question

I have created a custom AuthorizationAttribute which I’m placing on my controllers. I followed this article. I’ve implemented custom authorization logic in the OnAuthorization method and this works fine. When the user fails authorization I’m currently doing the following:

// if authorization check fails...
filterContext.Result = new HttpUnauthorizedResult();

This displays a username/password prompt.

My question is what is the recommended way send the user to a “Access Is Denied” type page when they fail authorization?

I am using MVC3.

Answer 1

In the end I went for a straight redirect:

public override void OnAuthorization(AuthorizationContext filterContext)
...
// if authorization check fails...
filterContext.Result = new RedirectResult(AccessDeniedPage);

Edit: Rob Conery has a very good article describing this in detail with ASP.NET MVC: Securing Your Controller Actions