Take the 2-minute tour ×

MSDN explicitly says it should do 401 redirect, but I'm getting a 302 redirect on FF, and this is causing problems in AJAX requests as the returned status is 200 (from the redirected page).


I've found someone else with the same problem: http://blog.nvise.com/?p=26

Any other solution, besides his?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

The Authorize attribute does return a Http 401 Unauthorized response. Unfortunately, however if you have FormsAuthentication enabled, the 401 is intercepted by the FormsAuthenticationModule which then performs a redirect to the login page - which then returns a Http 200 (and the login page) back to your ajax request.

The best alternative is to write your own authorization attribute, and then if you get an unauthenticated request that is also an Ajax request, return a different Http status code - say 403 - which is not caught by the formsAuthenticationModule and you can catch in your Ajax method.

share|improve this answer

I really like this solution. By changing the 302 response on ajax requests to a 401 it allows you to setup your ajax on the client side to monitor any ajax request looking for a 401 and if it finds one to redirect to the login page. Very simple and effective.


protected void Application_EndRequest()
    if (Context.Response.StatusCode == 302 &&
        Context.Response.StatusCode = 401;

Client Side Code:

 $(function () {
        statusCode: {
          401: function () {
            location.href = '/Logon.aspx?ReturnUrl=' + location.pathname;
share|improve this answer
Code worked perfectly for me. Thanks. –  njr101 Jun 14 '12 at 11:25
This is a bad practice, because all request should be cheched in EndRequest, included all static files. –  Fernando JS Jun 7 at 14:01

Your Answer


