How to return custom message if Authorize fails in WebAPI

Question

In my WebAPI project, I have number of apis which are decorated with [Authorize] attribute.

[Authorize]
public HttpResponseMessage GetCustomers()
{
   //my api
}

In case user doesn't have the right token, an access denied exception is returned to the user.

But what I need is that in any such case, I need to return the custom response message as.

{
  "StatusCode" : 403,
  "message": "You donot have sufficient permission"
}

How do I return this custom message in case authorization fails.

Please note:

I am using Owin - Token based authentication.
I am not storing the access token in my database or anywhere else.

have a read of the answers here: http://stackoverflow.com/questions/20149750/owin-unauthorised-webapi-call-returning-login-page-rather-than-401 — Dai Bok, Feb 28 '17 at 10:03
http://stackoverflow.com/questions/2578756/how-to-make-authorize-attribute-return-custom-403-error-page-instead-of-redirect — Thiago Custodio, Feb 28 '17 at 10:44

MANISH KUMAR CHOUDHARY · Accepted Answer · 2017-02-28T11:01:00.613

42

There are different ways to do this but one of the best way could be custom authorization attributes.You just need to inherit the AuthorizeAttribute and override HandleUnauthorizedRequest() method of it.

public class CustomAuthorization : AuthorizeAttribute
{
    protected override void HandleUnauthorizedRequest(HttpActionContext actionContext)
    {
        actionContext.Response = new HttpResponseMessage
        {
            StatusCode = HttpStatusCode.Forbidden,
            Content = new StringContent("You are unauthorized to access this resource")
        };
    }
}

and use this like(CustomAuthorization should be used in-place of Authorize)

    [CustomAuthorization]       
    public IHttpActionResult Get()
    {
        return Ok();
    }

Otherwise you can also catch the status code in client side and display the custom message of your choice.

edited Feb 28 '17 at 11:01

answered Feb 28 '17 at 10:46

MANISH KUMAR CHOUDHARY

3,396
3
22
34

Thanks mate :) It addressed my requirement. As you mentioned there are number of ways, I would be grateful if you can add one more way – Kgn-web Feb 28 '17 at 10:56
other ways could be handle exception in client side or handle exception in global application level but the best way I mention above as per my knowledge – MANISH KUMAR CHOUDHARY Feb 28 '17 at 10:58
1

Okay. Sounds great. Once again Thanks :) – Kgn-web Feb 28 '17 at 10:59
3

how can this be done in .net core?? have been searching but everything seems to move towards cliams and policys. Just need something simple like this? Thanks – Costas Aletrari Nov 06 '18 at 07:54
2

This no longer works with MVC 5 as HandleUnauthorizedRequest takes a parameter of type System.Web.Mvc.AuthorizationContext – Spencer Sullivan Nov 19 '19 at 19:39
What is solution in .net core 5? – M Komaei Aug 19 '21 at 13:18

How to return custom message if Authorize fails in WebAPI

1 Answers1

Linked