title: Handling session timeout in ajax calls
body: <p>I'm making an ajax call using jquery to an asp.net mvc controller action:</p>
  
  <pre><code>[AcceptVerbs(HttpVerbs.Post)]
          public ActionResult GetWeek(string startDay)
          {
              var daysOfWeek = CompanyUtility.GetWeek(User.Company.Id, startDay);
              return Json(daysOfWeek);
          }
  </code></pre>
  
  <p>When session times out, this call will fail, as the User object is stored in session. I created a custom authorize attribute in order to check if session was lost and redirect to the login page. This works fine for page requests, however it doesn't work for ajax requests, as you can't redirect from an ajax request:</p>
  
  <pre><code>[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
      public class AuthorizeUserAttribute : AuthorizeAttribute
      {
          protected override bool AuthorizeCore(HttpContextBase httpContext)
          {
              if (!httpContext.Request.IsAjaxRequest())
              {//validate http request.
                  if (!httpContext.Request.IsAuthenticated
                      || httpContext.Session["User"] == null)
                  {
                      FormsAuthentication.SignOut();
                      httpContext.Response.Redirect("~/?returnurl=" + httpContext.Request.Url.ToString());
                      return false;
                  }
              }
              return true;
          }
      }
  </code></pre>
  
  <p>I read on another thread that when the user isn't authenticated and you make an ajax request, you should set the status code to 401 (unauthorized) and then check for that in js and redirect them to the login page. However, I can't get this working:</p>
  
  <pre><code>protected override void OnActionExecuting(ActionExecutingContext filterContext)
          {
              if (Request.IsAjaxRequest() &amp;&amp; (!Request.IsAuthenticated || User == null))
              {
                  filterContext.RequestContext.HttpContext.Response.StatusCode = 401;
              }
              else
              {
                  base.OnActionExecuting(filterContext);
              }
          }
  </code></pre>
  
  <p>Basically, it'll set it to 401, but then it'll continue into the controller action and throw an object ref not set to an instance of an object error, which then returns error 500 back to the client-side js. If I change my custom Authorize attribute to validate ajax requests as well and return false for those that aren't authenticated, that makes the ajax request return my login page, which obviously doesn't work.</p>
  
  <p>How do I get this working?</p>