After throwing a Security Exception, redirect to Login page...

Question

I'm using WebForms and Asp.Net Routing.

When trying to implement security on a members folder, I'm following the directions here :

http://blogs.msdn.com/b/mikeormond/archive/2008/06/21/asp-net-routing-and-authorization.aspx

  private IHttpHandler GeneratePage(string VN, RequestContext RC)
  {
    string virtualPath
      = string.Format("~/Members/{0}.aspx", VN);

    if (UrlAuthorizationModule.CheckUrlAccessForPrincipal(virtualPath,
      RC.HttpContext.User,
      RC.HttpContext.Request.HttpMethod))
    {
      if (virtualPath != null)
      {
        return (Page)BuildManager.CreateInstanceFromVirtualPath(virtualPath, typeof(Page));
      }
    }
    else
    {
      throw new SecurityException();
    }

    return null;
  }
}

However, I don't just want to throw a security Exception, I would like to redirect to the login page. I'd rather not hard-code a Response.Redirect and I don't think this is the right way to do it anyhow.

What's the "proper" way to pass control to the Authorization engine and redirect to the Default Login page?

Answer 1

You can't have both.

Thowing an exception terminates the code path.

Alternatively you can call FormsAuthentication.RedirectToLoginPage(string extraQueryString) and pass an arg that lets you inform the user of the problem on the login page.

e.g.

FormsAuthentication.RedirectToLoginPage("error=authorization-failure")

You would, of course, need to write code in the login page to recognize this.