Returning an HTTP 403.7 HTTPResponseMessage

Question

If you're implementing your own AuthorizeAttribute, and you override HandleUnauthorizedRequest, you set HttpActionContext.Response to an HttpResponseMessage.

The HttpResponseMessage constructor takes an instance of the HttpStatusCode enumeration as an argument.

This enumeration contains values for the common top-level HTTP codes:

• HttpStatusCode.OK = 200
• HttpStatusCode.NotFound = 404
• Etc.

There is a value of HttpStatusCode.Forbidden = 403. But there is not a value for 403.7 - Client Certificate Required. Or, for that matter, for any of the other sub-codes.

How do you return a sub-code error?

Answer 1

There's a reason that you can't set HttpActionContext.Response to sub-code error.

Sub-codes aren't returned in the response. The HTTP protocol doesn't support them.

Code on the server can return sub-code errors, and code on the server can use the sub-codes for logging, error handling, etc. Returning a 404.7 might return a different page than a 404.6.

But the code sent to the client will be a plain 404, regardless.