Redirect to “You Are Forbidden” page without changing URL ASP.NET MVC

Question

I set up a custom Authorization Attribute in my project to do some checks on a user's permissions. If they aren't allowed to do a certain activity, they get redirected to a "You Are Forbidden" page via RedirectToRouteResult . However, I would like to make this function without changing the URL so the user can refresh the page if they receive permission. Is this possible?

How I'm doing it currently. It sends to the URL Forbidden/ .

[AttributeUsage(AttributeTargets.Method)]
public class AuthActivityAttribute : ActionFilterAttribute
{
    public string ActivityName { get; set; }
    public int ActivityId = 0;

    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        if (!ViewIsAuthorizedActivity(ActivityName))
        {
            filterContext.Result = Forbid();
            base.OnActionExecuting(filterContext);
        }
    }

    public RedirectToRouteResult Forbid()
    {
        return new RedirectToRouteResult(
            new RouteValueDictionary
                {
                    { "controller", "Home" },
                    { "action", "Forbidden" },
                    { "Activity", ActivityId },
                    { "area", ""}
                });
    }
    // other stuff
}

Edit / Solution:

I ended up using a combination of rendering PartialView for GET Requests and RedirectToRouteResult for POST Requests. I chose this for two reasons:

1. The user has the page loaded before losing permission, therefore the Forbidden partial view isn't loaded. Without the RedirectToRouteResult on POSTs, they could POST even though they don't have permission.

2. Someone could attempt to over post the page and have some success if they hit some Included values.

Attribute:

public override void OnActionExecuting(ActionExecutingContext filterContext)
{
    if (!ViewIsAuthorizedActivity(ActivityName))
    {
        string requestMethod = filterContext.HttpContext.Request.HttpMethod;

        if (requestMethod == "GET")
        {
            filterContext.Controller.ViewBag.Authorization = "FORBIDDEN";
        }
        else if (requestMethod == "POST")
        {
            filterContext.Result = new RedirectToRouteResult(
            new RouteValueDictionary
                {
                    { "controller", "Foo" },
                    { "action", "Bar" },
                    { "area", ""}
                });
        }

        base.OnActionExecuting(filterContext);
    }
}

View:

@if (ViewBag.Authorization == "FORBIDDEN")
{
    ViewBag.Title = "Forbidden!";
    @Html.Partial("~/Views/Home/Forbidden.cshtml");
}
else
{
    <!-- Page -->
}

Answer 1

a partial is the way to go. Add a partial to your page that looks like this:

@if(ViewData["FORBIDDEN"] == true)
{

<div id="forbidden">

<div/>
}
else{
rest of page here
}

in your action check for permission and set the ViewData["FORBIDDEN"] based on it