title: Forms Authentication: How to handle unauthorized authenticated user
body: <p>I am trying to setup a very basic Forms authentication example.</p>
  
  <p>It is correctly redirecting unauthenticated users to the login page
  and on submit verifying the credentials and if correct calling:</p>
  
  <pre><code>FormsAuthentication.RedirectFromLoginPage(username.Text, false);
  </code></pre>
  
  <p>If the user is one named in the authorization section they get their page.
  If not it bounces them back to the login page with no error.</p>
  
  <p>How can I redirect correctly authenticated but unauthorized users to a specific error page or detect the authorization error to display an error message on the login page bounce back?  </p>
  
  <p>Here is my web.config</p>
  
  <pre><code>   &lt;authentication mode="Forms"&gt;
        &lt;forms name=".ASPXAUTH" loginUrl="/forms/Login" /&gt;
      &lt;/authentication&gt;
      &lt;authorization&gt;
        &lt;deny users="?" /&gt;
        &lt;allow users="username1, username2" /&gt;
        &lt;deny users="*" /&gt;
      &lt;/authorization&gt;
  </code></pre>
  
  <p><strong>Update:</strong></p>
  
  <p>Based on the answers / comments / research I've got two working solutions.</p>
  
  <ol>
  <li><p>Put the following in the Page_Load method of your Login form:</p>
  
  <pre><code>    if (Request.IsAuthenticated &amp;&amp; !string.IsNullOrEmpty(Request.QueryString["ReturnUrl"]))
      {
          // This is an unauthorized, authenticated request... 
          Response.Redirect("FailedAuthorization.aspx");
      }
  </code></pre></li>
  </ol>
  
  <p><strong>OR</strong></p>
  
  <ol start="2">
  <li><p>Put the following in your Global.aspx file:</p>
  
  <pre><code>protected void Application_EndRequest(object sender, EventArgs e)
  {
      if (Response.StatusCode == 401)
      {
          //Use the built in 403 Forbidden response
          Response.StatusCode = 403;
  
          //OR redirect to custom page
          //Response.Redirect("FailedAuthorization.aspx");
      }
  }
  
  protected void Application_AuthenticateRequest(object sender, EventArgs e)
  {
      if (Request.IsAuthenticated)
      {
          // Requires ASP.NET &gt;= 4.5
          Response.SuppressFormsAuthenticationRedirect = true;
      }
  }
  </code></pre></li>
  </ol>
  
  <p>Thank you for all the help with this!</p>