How do I hide the username/password prompt that appears when a [WebMethod] gets called on an invalid session?

Question

I have a .aspx with a static method decorated with the [WebMethod] attribute and a ScriptManager on the page, so that the WebMethod can be called with PageMethods.MethodName(). Forms authentication is enabled.

This works well in all scenarios except where the WebMethod is invoked on an expired session. When that happens, the service returns HTTP 401 and a username/password dialog pops up! I would much rather the user be redirected, as they are with any other request (including asynchronous postbacks). Is there a way to trap that specific condition, or to configure the application to do the right thing when presented with this case?

edited to correct actual HTTP status code - it's an HTTP 401, not a 403

Answer 1

You could setup a webservice for your application that could check IsUserAuthenticated() before you call your WebMethod. If it returns false you could then do a redirect in javascript to your login page and avoid the error. Make sure that this web service doesn't require authentication.

The problem is that the AuthenticateRequest event gets processed before your page ever gets control. Which means there is nothing you can do in the codebehind to solve this issue. Because it's the FormsAuthenticationModule which is rejecting the request and returning the HTTP 403.

Answer 2

We havet the same problem. We resolved this by disabling Windows Authentication on IIS. That is strange, because our application is configured to use FormsAuthentication too.