Custom Authorize attribute not working on expired ajax requests.

Question

Hi. I have a custom authorize attribute on my controllers and it is not being called on expired ajax requests. I'm using forms authentication, and call controller methods via $.ajax (jQuery). The ajax request returns my login page and I don't seem to be able to intercept this.

Thank you.

UPDATE: I figured out why: I commented the authorization section in my web.config like follows:

  <authentication mode="Forms">
      <forms loginUrl="/Login" timeout="1" slidingExpiration="false"/>
    </authentication>
    <!--<authorization>
      <deny users="?"/>
    </authorization>-->

Now my authorization filter is being called even after expiration. Turns out that Web.config authorization rules take precedence over Authorize filters.

Answer 1

Don't return 401 unauthorized. ASP.NET intercepts that and redirects to the login page defined in web.config. For AJAX, instead return something else, like 403.