未经授权的AJAX请求返回状态码200，而不是401

Question

In MVC 5, I override HandleUnauthorizedRequest() and check if the request is from AJAX.

I have also registrated a Global ajaxComplete , for handeling 401 AJAX requests, but the status code is still 200 after being in HandleUnauthorizedRequest() .

Question: Do I have to manually change the statuscode in filterContext in the function HandleUnauthorizedRequest() ?

Unauthorized AJAX request detected

protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
{
    if (filterContext.HttpContext.Request.IsAjaxRequest())
    {
        // <-- in here
        filterContext.Result = new JsonResult
        {
            Data = new
            {
                returnUrl = "foo"
            },
            JsonRequestBehavior = JsonRequestBehavior.AllowGet
        };
    }
    else
    {
        base.HandleUnauthorizedRequest(filterContext);
    }
}

Global ajaxComplete registration

$(document).ajaxComplete(function (e, xhr, settings) {
    console.log('xhr.status: "' + xhr.status +'"'); // 200 - i want 401
    if(xhr.status === 401) {
        window.location.replace(urlHelper.getUrlNotAuthorized());
    }
});

"Working but hacked solution until I find a solution with ajaxComplete.

It check if the Users request was authorized. Downside is that I have to check isAuthorized() everyway i make a request. That's why I would like to use a global ajaxComplete, so I never miss one.":

Check if the Users AJAX request was authorized

isAuthorized = function (result) {
    try {
        var obj = JSON && JSON.parse(result) || $.parseJSON(result);
        // Here, obj can still be a parsed JsonResult, from when getting GetDatatableRows(), so we also need to check on returnUrl which is distinct
        // obj will only contain returnUrl if the JSON was returned from Shield validation
        if (obj && obj.returnUrl) {
            window.location.replace(urlHelper.getUrlNotAuthorized() + '?returnUrl=' + encodeURIComponent(obj.returnUrl));
            return false;
        }
    } catch (e) {
    }
    return true;
};

AJAX request where result is either a Partial View or JSON

partialViewService.changePartialViewService(url, data)
.done(function (result) {
    if (isAuthorized(result)) {
        // use result
    }
});

Answer 1

Yes - I haven't checked this, but try adding the line indicated. Specifying code 401 does not filter through to the result you want. (I suspect this is due to Identity intercepting code 401 specifically):

protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
{
    if (filterContext.HttpContext.Request.IsAjaxRequest())
    {
        // Add this (code 401 does not work)
        filterContext.HttpContext.Response.StatusCode = 412;
        // <-- in here
        filterContext.Result = new JsonResult
        {
            Data = new
            {
                returnUrl = "foo"
            },
            JsonRequestBehavior = JsonRequestBehavior.AllowGet
        };
    }
    else
    {
        base.HandleUnauthorizedRequest(filterContext);
    }
}