Question

I have seen a nice example whereby the MVC controller class inherits from another controller class which handles an exception and returns a view with the error inside like so:

public class ApplicationController : Controller
{
    public ActionResult NotFound()
    {
        return View("NotFound");
    }

    public ActionResult InsufficientPriveleges()
    {
        return View("InsufficientPriveleges");
    }

    protected override void OnException(ExceptionContext filterContext)
    {
        if (filterContext.Exception is NotFoundException)
        {
            filterContext.Result = NotFound();
            filterContext.ExceptionHandled = true;
            return;
        }
        if (filterContext.Exception is InsufficientPrivelegesException)
        {
            filterContext.Result = InsufficientPriveleges();
            filterContext.ExceptionHandled = true;
            return;
        }

        base.OnException(filterContext);
    }
}

However, I’ve noticed that say for example my controller is loading in a partial view for something the user should not have access to, the error will then be shown inside the partial view on the page.

I’d like the whole page to show the error, in effect the exception should redirect to a completely new page. How can I achieve this using the current class shown above?

Answer 1

You can create a mapping from HTTP result codes to specific error handlers in your web.config:

<customErrors mode="On" defaultRedirect="~/Error">
  <error statusCode="401" redirect="~/Error/Unauthorized" />
  <error statusCode="404" redirect="~/Error/NotFound" />
</customErrors>

and then create a custom error controller

public class ErrorController
{ 
        public ActionResult Index ()
        {
            return View ("Error");
        }

        public ActionResult Unauthorized ()
        {
            return View ("Error401");
        }

        public ActionResult NotFound ()
        {
            return View ("Error404");
    }
    }

and then throw an HttpException from your controllers

public ActionResult Test ()
{
    throw new HttpException ((int)HttpStatusCode.Unauthorized, "Unauthorized");
}

another alternative is to use a custom FilterAttribute to check permissions which throws a HttpException

[Authorize (Roles = SiteRoles.Admin)]
public ActionResult Test ()
{
  return View ();
}