title: Check MVC Controller Permission and return 401 Unauthorized to angularJS app
body: <p>I have an angularJS application which communicates with MVC Controller to get some data.</p>
  
  <p>I have implemented a class <code>RBACAuthorizeAttribute</code> which inherits from <code>AuthorizeAttribute</code> to check if the user has permission to execute the particular action on the controller. Implementation of this class is shown below:</p>
  
  <pre><code>public class RBACAuthorizeAttribute : AuthorizeAttribute
  {
      public override void OnAuthorization(AuthorizationContext filterContext)
      {
          var controllerName = filterContext.ActionDescriptor.ControllerDescriptor.ControllerName;
          var webAction = filterContext.ActionDescriptor.ActionName;
          var user = filterContext.HttpContext.User.Identity.Name;
  
  
          if (!HasPermission(controllerName, webAction, user))
          {
              filterContext.Result = new RedirectToRouteResult(
                                             new RouteValueDictionary {
                                              { "action", "Index" },
                                              { "controller", "Unauthorized" } });
          }            
      }
  
      private bool HasPermission(string controllerName, string webAction, string user)
      {
          //Check if the user has permission here.
          //return true or false.
          return false; 
      }
  }
  </code></pre>
  
  <p>The actual controller on which I am checking the permission is given below:</p>
  
  <pre><code>public class MyDataController : Controller
  {
      [Route("IndividualDetails/{id}")]
      [RBACAuthorize]
      public JsonResult GetIndividualDetails(string id)
      {
          var data = GetDataFromSomeTableInDatabase(id);
  
          return data;
      }
  </code></pre>
  
  <p><code>UnauthorizedController</code> class definition is:</p>
  
  <pre><code>public class UnauthorizedController : Controller
  {
      public ActionResult Index()
      {
          return new HttpStatusCodeResult(HttpStatusCode.Unauthorized);
      }
  } 
  </code></pre>
  
  <p>Below is the AngularJS function which invokes the controller:</p>
  
  <pre><code>function getDetails(id) {
          return $resource(remoteServiceUrl + '/MyData/IndividualDetails/:id', { id: id })
              .get().$promise;
      };  
  
  function loadUserDetails(id) {
      getDetails(id).then(
          function (result) {
              console.log(result);
          }, 
          function (reason) {
              console.log(reason);
          }
      );
  }
  </code></pre>
  
  <p>I am expecting the <strong>401-Unauthorized</strong> response in the above <code>loadUserDetails</code> function but I am getting quite a big array in <code>result</code> which contains some html page. The issue seems to be in the implementation of <code>RBACAuthorizeAttribute</code> class. So to get the <strong>401-Unauthorized</strong> error on client side, can anyone point me to the right direction please.    </p>
  
  <p><strong>Edit</strong>:
  I am using Asp.Net Identity system and the version of Asp.NET is 5.</p>