Why does setting WebOperationContext.Current.OutgoingResponse.StatusCode = HttpStatusCode.Redirect cause SecurityException?

Question

I'm working on a Rest Service in .Net 4, and I need to perform a redirect.

A little description of what I'm doing: I have a silverlight application that contains a button. When I click the button, I send a POST request to my REST service with some information. From that information, I create a URL and (try to) redirect the browser. Here's the code for the method in the service:

[WebInvoke(Method = "POST", UriTemplate = "OpenBinder")]
public void OpenBinder(int someId)
{
    string url = getUrl(someId);
    if (WebOperationContext.Current != null)
    {
        WebOperationContext.Current.OutgoingResponse.Location = url;
        WebOperationContext.Current.OutgoingResponse.StatusCode = HttpStatusCode.Redirect;
    }
}

This seems to execute correctly, but when I call EndGetResponse on the client, I see that a "Security Error" occurred. It's System.Security.SecurityException, but I don't get any more details than that. Any ideas on what could be going on here?

You can't set the code directly - see http://social.msdn.microsoft.com/Forums/en/adodotnetdataservices/thread/f0cbab98-fcd7-4248-af81-5f74b019d8de — stuartd, Aug 23 '12 at 14:39
This is not correct. Otherwise they wouldn't have exposed the setter on the properties, though I see your point. — TheTFo, Aug 24 '12 at 14:00

score 0 · Accepted Answer · answered Aug 23 '12 at 14:22

0

Without more info, I am not sure what your specific security error is, but generally with this type of situation, your redirect should happen on the client side in the response handler. Can you restructure your code to have the client redirect?

answered Aug 23 '12 at 14:22

feathj

3,019
2
22
22

A client redirect would be preferable, I agree, however, data in the url is sensitive and we'd rather not pass it around more than we need to. – TheTFo Aug 24 '12 at 13:57

score 0 · Answer 2 · answered Aug 24 '12 at 13:59

0

OK, so my code was actually working correctly. When I looked through Fiddler, I noticed it was it was making the correct request to the Url. The problem was clientacesspolicy.xml was stopping it.

answered Aug 24 '12 at 13:59

TheTFo

741
2
8
25

Why does setting WebOperationContext.Current.OutgoingResponse.StatusCode = HttpStatusCode.Redirect cause SecurityException?

2 Answers2