Custom Authorize attribute not working on expired ajax requests

Question

I have a custom authorize attribute on my controllers and it is not being called on expired ajax requests. I'm using forms authentication, and call controller methods via $.ajax (jQuery). The ajax request returns my login page and I don't seem to be able to intercept this.

Thank you.

UPDATE: I figured out why: I commented the authorization section in my web.config like follows:

  <authentication mode="Forms">
      <forms loginUrl="/Login" timeout="1" slidingExpiration="false"/>
    </authentication>
    <!--<authorization>
      <deny users="?"/>
    </authorization>-->

Now my authorization filter is being called even after expiration. Turns out that Web.config authorization rules take precedence over Authorize filters.

I spent three hours racking my brain on this one. Didn't even think about commenting out the code. Worked great for MVC 5. — BeanFlicker, Oct 22 '15 at 17:46

score 4 · Accepted Answer · answered Oct 29 '09 at 14:47

4

Don't return 401 unauthorized. ASP.NET intercepts that and redirects to the login page defined in web.config. For AJAX, instead return something else, like 403.

answered Oct 29 '09 at 14:47

Craig Stuntz

125,891
12
252
273

1

For whatever reason AuthorizeCore (overriden) isn't even being called... I'm trying to figure out what could prevent it. – Valentin V Oct 29 '09 at 14:52
+1 Its awfull, that asp.net picks up the 401 and redirects automatically. This is a good answer! – Christian13467 Oct 29 '09 at 15:02

score 1 · Answer 2 · edited Jul 21 '18 at 07:23

1

There is also a good blog on this over here:

https://www.trycatchfail.com/2011/01/17/handling-authorization-failures-for-ajax-requests-in-asp-net-mvc-applications/

edited Jul 21 '18 at 07:23

TombMedia

1,962
2
22
27

answered Mar 10 '11 at 16:02

Mike

1,405
1
17
27

score 0 · Answer 3 · edited May 23 '17 at 12:23

0

Use context.HttpContext.Request.IsAjaxRequest() to detect if request is an Ajax request or not. Check more here:

Authorize attribute and jquery AJAX in asp.net MVC

edited May 23 '17 at 12:23

Community

1
1

answered Mar 15 '13 at 07:22

Amit M

1

Custom Authorize attribute not working on expired ajax requests

3 Answers3