title: Asp.net mv5 403 or 401 code if user is not in correct role
body: <p>Asp.net MVC5 and WebApi2 have <code>Authorize</code> attributes on controllers that let you filter on roles. For example:</p>
  
  <pre><code>[Authorize(Roles="HomePageUser")]
  public ActionResult Home(){
      return View();
  }
  </code></pre>
  
  <p>But this emits a <code>401</code> status code if the user is authenticated but not in the correct role. My question is simply: is this the best approach or should I write a filter that sends <code>403</code> if they are authenticated but in the wrong role?</p>
  
  <p>To see why this is an issue, consider: the user who is not in role <code>HomePageUser</code> logs in and tries to go to the <code>Home</code> page. The <code>Authorize</code> filter emits a 401 code which the Owin context then intercepts and turns into a 302 redirect to the login page. But, the user is in fact logged in and no amount of logging in can rectify the fact that the user's identity lacks the permissions to view the page.</p>
  
  <p>In practical terms, this all means frustration for the users because the automatic redirecting never gives them any information about why they can't see the page--they are likely to assume they typed in their password incorrectly.</p>
  
  <p>It seems to me that the key failure here is that the <code>Authorize</code> filter lied--the user was not unauthorized but forbidden, and it should have issued a 403.</p>
  
  <p>Here's the code I have in mind to fix this. For MVC actions:</p>
  
  <pre><code>using System.Web.Mvc;
  
  public class AuthorizeOrForbidAttribute : AuthorizeAttribute
  {
      protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
      {
          if (filterContext.HttpContext.User.Identity.IsAuthenticated)
          {
              filterContext.Result = new HttpStatusCodeResult(403);
          }
          else
          {
              filterContext.Result = new HttpUnauthorizedResult();
          }
      }
  }
  </code></pre>
  
  <p>and for Web Api actions:</p>
  
  <pre><code>using System.Web.Http;
  using System.Diagnostics.CodeAnalysis;
  using System.Diagnostics.Contracts;
  using System.Linq;
  using System.Net;
  using System.Net.Http;
  using System.Security.Principal;
  using System.Web.Http.Controllers;
  using System.Web.Http.Filters;
  using System.Web.Http.Properties;
  
  public class AuthorizeOrForbidAttribute: AuthorizeAttribute
  {
      protected override void HandleUnauthorizedRequest(System.Web.Http.Controllers.HttpActionContext actionContext)
      {
          if (actionContext.RequestContext.Principal.Identity.IsAuthenticated)
          {
              actionContext.Response = actionContext.ControllerContext.Request.CreateErrorResponse(HttpStatusCode.Unauthorized, actionContext.RequestContext.Principal.Identity.Name+" does not have permissions for this request.");
          }
          else
          {
              actionContext.Response = actionContext.ControllerContext.Request.CreateErrorResponse(HttpStatusCode.Unauthorized, "Authorization has been denied for this request.");
          }
      }
  }
  </code></pre>
  
  <p>From there it is easy enough to redirect these status codes to the appropriate error pages depending on what you want the user to see.</p>
  
  <p>Is this a good approach? I'm worried because I'm wondering if there's a good reason Microsoft didn't do this in the first place.</p>