I have an jquery .ajax posting to a asp.net mvc method that has an 'authorized' attribute. Ajax callback is successful even when the user is not authorized to post to the action. First, what is the ajax success callback basing the success on? Second, to test whether the actual method was carried out, I returned a "success" string from the action and use javascript from there. Is this second way ok?
AJAX is HTTP requests using Javascript. The same HTTP requests your browser makes when you fetch a web page.
The AJAX success is simply saying that it managed to fetch the URL successfully, ie. there were no network errors, the server didn't return a 404 or similar error, etc.
Whether the method you are calling returned a successful result or not is a different matter. All AJAX can do is tell you it successfully got a result, but you will have to find out if this result indicated success or failure for your application.
The difference here is between the success of the javascript AJAX mechanism working at all (i.e. proceeding to readyState==4) vs the success of the httprequest itself (i.e. status==200).
To javascript, a 500 range error produced by your application will work perfectly well as a request (see how nicely that stacktrace looks formatted in HTML?). Remember to check both your readyState and status on the XHR object.