ASP.Net MVC Authorisation action filter question

Question

Hi,

I'm trying to understand how error handling works when using the Authorize [Authorize] Action Filter in MVC Preview 4.

I have an action that looks like this:

    [Authorize(Roles = "DOMAIN\\NOTAUTHORISED_ROLE" )]
    [HandleError]
    public ActionResult NeedAuthorisation()
    {
        throw new NotImplementedException();
    }

When I visit the url: http://localhost:2197/testAuthorisation/NeedAuthorisation I get a blank page in my browser. In Firebug I can see that a request was made and a response-status of '401 - Unauthorised' has been returned. But I'm not being redirected or having a customError returned. Everything works as expected when using a role that I'm authorized for.

UPDATE This is using Windows authentication. I'm in the middle of writing some code to try out Forms authentication to see if I get the same issue. I have set and have created error pages, both in the testAuthorisation folder and the Shared folder.

Thanks, in advance!

Answer 1

If you've got CustomErrors set to Off or RemoteOnly then you won't get re-directed to the page specified by HandleError (default is Error.aspx). Set it to "On" and then see what happens. Any custom error pages you specify explicitly will take precedence, however, so you need to remove these, and have just:

<customErrors mode="On" />

Answer 2

You need an error view in the corresponding view folder, i.e. you need the file Views/TestAuthorization/Error.aspx in order to have anything show up.

You can also customize this behaviour by what view that you want to use and to what exception you want it to be triggered with.

[HandleError(ExceptionType = typeof(SqlException), View = "DatabaseError")]]
[HandleError(ExceptionType = typeof(NullReferenceException), View = "LameErrorHandling")]]

Answer 3

I eventually found this which solved my problem.

http://www.asp.net/learn/mvc/tutorial-18-vb.aspx

quote:

"Exactly what happens when you attempt to invoke a controller action without being the right permissions depends on the type of authentication enabled. By default, when using the ASP.NET Development Server, you simply get a blank page. The page is served with a 401 Not Authorized HTTP Response Status."

Is it OK to answer your own question here?