未经授权的消息，状态为200 OK

Question

I am doing the backend according to the given architecture given by the company I recently started working. I am new to C# and now I'm trying to do some post/get/put methods for some api-s. There is a problem which I couldn't solve it. Postman says: { "code": 1, "message": "Unauthorize" } But the status code is 200 OK.

UserController.cs

[Route("v1/users")]
[Produces("application/json")]
public class UserController : BaseController
{
    /// <summary>
    ///     Get list of users (Authorize)
    /// </summary>
    /// <returns>
    /// </returns>
    [ProducesResponseType(typeof(BaseResponseModel<List<UserResource>>), 200)]
    [HttpGet]
    public async Task<IActionResult> Get()
    {
        var user = await _userService.GetUserResourcesAsync();

        return Success(user);
    }
 }

This doesn't make any sense, or am I so dumb to realise the problem? I have a login method and I can login, I get the success code, then I do this: enter image description here Header

IProductService.cs

    public interface IProductService
{
    Task<ProductDto>  GetAsync(int id);
}

ProductService.cs

        public async Task<ProductDto> GetAsync(int id)
    {
        var product = await _context.Product.SingleOrDefaultAsync(p => p.Id == id);
        return _mapper.Map<ProductDto>(product);

    }

ProductDto.cs

 public class ProductDto
{
    public int Id { get; set; }

    public CategoryDto CategoryId { get; set; }

    public string Title { get; set; }

    public bool AllowEdit { get; set; }

    public string ItemCode { get; set; }

    public string CustomerCode { get; set; }
 }

Product.cs

[Table("Products")]
public class Product : DomainModel<int>
{
    [Required]
    public int ProductCategoryId { get; set; }

    [ForeignKey("ProductCategoryId")]
    public virtual ProductCategory ProductCategory { get; set; }

    [Required, StringLength(256)]
    public string Title { get; set; }

    [Required, DefaultValue(false)]
    public bool AllowEdit { get; set; }

    [StringLength(50)]
    public string ItemCode { get; set; }

    [StringLength(50)]
    public string CustomerCode { get; set; }
}

Answer 1

Using the ProducesResponseTypeAttribute , the attributed API actually defines what should be response code for specified types. See the definition of at ProducesResponseTypeAttribute .

How it works

Take following example which shows that the API throws the 404 error if the object is null:

public IActionResult GetById(string id)
{
    var post = <<Your logic here>>;
    if (post == null)
    {
        return NotFound();
    }

    return Json(post);
}

Now the same method can be changed to following, which would return 404 by using the ProducesResponseType instead of the code is being written in your API logic.

[ProducesResponseType((int)HttpStatusCode.NotFound)]
public IActionResult GetPostById(string id)
{
        var post = <<Your logic here>>;
        return Json(post);
    }

In cases, it might be good to also define a more explicit response type for successful calls. To do so, add a ProducesResponseTypeAttribute for status code with type. ( return type as parameter, which makes the Type property of Produces redundant). This is valuable, if you want to return different things from one and the same method, for example, the following returns two different types depending on the returned status code:

[ProducesResponseType((int)HttpStatusCode.NotFound)]
[ProducesResponseType(typeof(Model), (int)HttpStatusCode.OK)]
public IActionResult GetById(string id)

What is your problem

Now if you see your code which defines this attribute as [ProducesResponseType(typeof(BaseResponseModel<List<UserResource>>), 200)] . And the code to fetch user :

var user = await _userService.GetUserResourcesAsync();

returns BaseResponseModel<T> . The BaseResponseModel should contain the Code and Message property. So here, the response returned by API is type of BaseResponseModel<T> , so API would return 200 HTTP Status as defined by attribute.

How to Fix

Either you return a different object in case of Unauthorize exception and attach the ProducesResponseType specific to that type OR handle the unathorized logic based at Authorize attribute.