IIS return 302 instead of 401

Question

Hi guys i m having a problem with CustomErrors in web.config, i'm trying to show a custom page for the error 401, but when a user try to access the controller and haven't authorization.

In this case the return is 302 but must be 401, i tried to use the Application_EndRequest() in Global.asax to change the Response.Status Code :

void Application_EndRequest(object sender, EventArgs e)
{
    if (Context.Response.StatusCode == 302)
    {
        Context.Response.Clear();
        Context.Response.StatusCode = 401;
    }
}

with this the error returned is the 401 but the page of custom errors is not displayed, just a default message of IIS

Unauthorized: Access is denied due to invalid credentials

how can i make the custom errors show the right page for 401 error ?

There are some hints about enabling/disable custom redirecting in http://stackoverflow.com/questions/1391373/how-do-i-check-for-a-302-response-webrequest — Anthony Horne, May 05 '14 at 22:33
this works when debugging locally using your Visual Studio ? you are getting this problem ONLY when running on IIS right ? — Yasser Shaikh, May 06 '14 at 06:13

score 0 · Answer 1 · answered May 06 '14 at 00:45

If you are using Forms Authentication, then 401 is handled internally by ASP.NET and used in the Challenge/Response mechanism for authentication. When you use authentication, you specify a login page, and when a user is not authorized, they are redirect to that page to log in.

There is a difference between a 401, which unauthorized and 403, which is Forbidden.

If you're using Windows Authentication, Digest, or Basic then you will get a 401 Challenge popup. ASP.NET intercepts 401 so that you don't get popups, and can instead deal with authentication errors in forms.

I'm using Forms Authentication, how can I cancel the redirect to login page and go to my custom page for error 401? I was looking for some related with HttpResponse.SuppressFormsAuthenticationRedirect but its only supported in .Net Framework 4.5 + — Lucas Konrath, May 06 '14 at 02:50

score 0 · Accepted Answer · answered May 07 '14 at 18:31

0

I found the solution for my problem here

Using a custom authorization attribute for redirect to the "AccessDenied" page

answered May 07 '14 at 18:31

Lucas Konrath

567
2
8
19

score -1 · Answer 3 · edited May 23 '17 at 12:20

-1

Take a look at the solution for custom errors in MVC answered on another question within stackoverflow at https://stackoverflow.com/a/620559/686674

You want to override Application_Error rather than Application_EndRequest.

edited May 23 '17 at 12:20

Community

1
1

answered May 05 '14 at 22:35

Pepto

1,434
10
13

ok.. i'll try it tomorrow. but seems to me an radical modification.. i would like to still using custom errors of ASP.NET – Lucas Konrath May 06 '14 at 02:54

IIS return 302 instead of 401

3 Answers3