title: With Cookie Auth in ASP.NET 5 Identity, how to get WebAPI to return 403
body: <p>I created a trivial webapi controller with the authorize tag as below. I call it with jquery when I'm not authenticated and I get in the response the message </p>
  
  <pre><code>{"Message":"Authorization has been denied for this request."}
  </code></pre>
  
  <p>but that carries a 200 success which means the jquery error handler success gets called.</p>
  
  <p>using WebAPI 2, I want a 403 thrown when not authorized, not a 200. How can I achieve this?</p>
  
  <p>Controller File:</p>
  
  <pre><code>   public class TenantWebApiController : ApiController
      {
          // GET: api/TenantWebApi
          [Authorize]
          public IEnumerable&lt;string&gt; Get()
          {
              return new string[] { "value1", "value2" };
          }
          ...
  </code></pre>
  
  <p>Index.cshtml</p>
  
  <pre><code>$(document).ready(function () {
      $.ajax({
          url: '/api/TenantWebApi',
          type: 'GET',
          dataType: 'json',
          data: {
              firstName: 'Peter',
              lastName: 'Kellner'
          },
          error: function(jqXHR, textStatus, errorThrown) {
              alert('An error occurred');
  
          },
          success: function(data, textStatus, jqXhr) {
              alert('success');
          }
      });
  });
  </code></pre>