Question

I manage all app erros in my Application_Error() in Global.asax:

protected void Application_Error(object sender, EventArgs e)
{
    Exception exception = Server.GetLastError();

    Log.LogException(exception);

    Response.Clear();

    HttpException httpException = exception as HttpException;

    RouteData routeData = new RouteData();
    routeData.Values.Add("controller", "Erro");

    if (httpException == null)
    {
        routeData.Values.Add("action", "Index");
    }
    else //It's an Http Exception
    {
        switch (httpException.GetHttpCode())
        {
            case 404:
                //Page not found
                routeData.Values.Add("action", "HttpError404");
                break;
            case 500:
                //Server error
                routeData.Values.Add("action", "HttpError500");
                break;

            // Here you can handle Views to other error codes.
            // I choose a General error template  
            default:
                routeData.Values.Add("action", "General");
                break;
        }
    }

    //Pass exception details to the target error View.
    routeData.Values.Add("error", exception);

    //Clear the error on server.
    Server.ClearError();

    //Avoid IIS7 getting in the middle
    Response.TrySkipIisCustomErrors = true;

    //Call target Controller and pass the routeData.
    IController errorController = new ErroController();
    errorController.Execute(new RequestContext(new HttpContextWrapper(Context), routeData));
}

So, I have a Custom Authorize Attribute in my app that handle Unauthorized Request and I want to redirect to Application_Error() manipulate that instead.

So, I do that:

protected override void HandleUnauthorizedRequest(AuthorizationContext context)
{
    if (context.HttpContext.Request.IsAuthenticated)
    {
        throw new HttpException(403, "Forbidden Access.");
    }
    else
    {
        base.HandleUnauthorizedRequest(context);
    }
}

In that way the Application_Error() is called, but it seems ugly to me to call a exception so directly, exist another way? What you think guys?

Answer 1

Your code is fine. By default if you call the base.HandleUnauthorizedRequest it throws a 401 exception which is intercepted by the forms authentication module and you get redirected to the login page (which might not be the desired behavior). So your approach is correct.

Another possibility is to directly render the corresponding error view if you don’t want to go through the Application_Error:

protected override void HandleUnauthorizedRequest(AuthorizationContext context)
{
    if (context.HttpContext.Request.IsAuthenticated)
    {
        context.Result = new ViewResult
        {
            ViewName = "~/Views/Shared/Forbidden.cshtml"
        };
    }
    else
    {
        base.HandleUnauthorizedRequest(context);
    }
}