title: Return HTTP 403 using Authorize attribute in ASP.Net Core
body: <p>When using ASP.Net WebAPI, I used to have a <a href="https://github.com/civicsource/http/blob/3c057dd79d9ce31cb4016adf4b2867a86ca080aa/Core/AuthorizeCorrectlyAttribute.cs" rel="noreferrer">custom <code>Authorize</code> attribute</a> I would use to return either an HTTP <code>403</code> or <code>401</code> depending on the situation. e.g. if the user is not authenticated, return a <code>401</code>; if the user is authenticated but doesn't have the appropriate permissions, return a <code>403</code>. <a href="https://stackoverflow.com/questions/3297048/403-forbidden-vs-401-unauthorized-http-responses">See here for more discussion</a> on that.</p>
  
  <p>It seems now, in the new ASP.Net Core, they <a href="https://stackoverflow.com/a/31465227/316108">don't want you overriding the <code>Authorize</code> attribute</a> anymore instead favoring a policy-based approach. However, it seems Core MVC suffers from the same "just return <code>401</code> for all auth errors" approach its predecessors have.</p>
  
  <p>How do I override the framework to get the behavior I want?</p>