title: Why does AuthorizeAttribute redirect to the login page for authentication and authorization failures?
body: <p>In ASP.NET MVC, you can mark up a controller method with <code>AuthorizeAttribute</code>, like this:</p>
  
  <pre><code>[Authorize(Roles = "CanDeleteTags")]
  public void Delete(string tagName)
  {
      // ...
  }
  </code></pre>
  
  <p>This means that, if the currently logged-in user is not in the "CanDeleteTags" role, the controller method will never be called.</p>
  
  <p>Unfortunately, for failures, <code>AuthorizeAttribute</code> returns <code>HttpUnauthorizedResult</code>, which always returns HTTP status code 401. This causes a redirection to the login page.</p>
  
  <p>If the user isn't logged in, this makes perfect sense. However, if the user is <em>already</em> logged in, but isn't in the required role, it's confusing to send them back to the login page.</p>
  
  <p>It seems that <code>AuthorizeAttribute</code> conflates authentication and authorization.</p>
  
  <p>This seems like a bit of an oversight in ASP.NET MVC, or am I missing something?</p>
  
  <p>I've had to cook up a <code>DemandRoleAttribute</code> that separates the two. When the user isn't authenticated, it returns HTTP 401, sending them to the login page. When the user is logged in, but isn't in the required role, it creates a <code>NotAuthorizedResult</code> instead. Currently this redirects to an error page.</p>
  
  <p>Surely I didn't have to do this?</p>