How to Return 401 Response from OnAuthorization Method - ServicesApiController

Question

I am exposing web API through ServicesApiController and want to authorize user through [AuthorizedUser(@"sitecore\ServicesAPI")] attribute of the function, everything is working fine, but instead of returning 401 status, Sitecore returning 404 status.

The solution I am thinking to terminate the request if authorization failed and return the request from the "OnAuthorization" method only or handle this scenario from 404 not found pipeline.

I am using this code for authorization

public override void OnAuthorization(HttpActionContext actionContext)
    {
        base.OnAuthorization(actionContext);
        var context = Context.User;
        //string test = context.ToString();
        if ((context.IsAuthenticated && context.Name.Equals(_user)))
            return;

        actionContext.Response =
            actionContext.ControllerContext.Request.CreateErrorResponse(HttpStatusCode.Unauthorized,
                "Unauthorized Access; User is " + Context.User.LocalName);
        base.OnAuthorization(actionContext);

    }

and validate the controller function like below:

[AuthorizedUser(@"sitecore\ServicesAPI")]

Answer 1

Try returning the response as :

actionContext.Response = new HttpResponseMessage((HttpStatusCode)401) { ReasonPhrase = "Unauthorized user" }

Answer 2

Try using AuthorizationContext.Result property.
So, here is full code of attribute:

using System.Net;
using System.Web.Mvc;
using Sitecore;

namespace [YOUR_NAMESPACE]
{
    public class AuthorizedUserAttribute : FilterAttribute, IAuthorizationFilter
    {
        private readonly string _user;

        public AuthorizedUserAttribute(string user)
        {
            _user = user;
        }

        public void OnAuthorization(AuthorizationContext filterContext)
        {
            var user = Context.User;
            if ((user.IsAuthenticated && user.Name.Equals(_user)))
                return;
            filterContext.Result = new HttpStatusCodeResult(HttpStatusCode.Unauthorized);
        }
    }
}

If you need also some JSON information in reponse as well, as with 401 error code, please see this stackoverflow question.

Answer 3

Please override HandleUnauthorizedRequest method to set unauthorized(401) response

public class CustomAuthorizeAttribute : AuthorizeAttribute  
{  
   public override void OnAuthorization(HttpActionContext actionContext)
   {
     // Here your core logic
   } 

   protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)  
   {  
      //set unauthorized(401) response
      filterContext.Result = new HttpUnauthorizedResult();  
   }  
}