ClaimsPrincipalPermission - Error Code

Question

I use the ClaimsPrincipalPermission for authorization in my asp 4.5 website.

This works fine.

But when the user tries to call a page which he is not allowed the error code returned is a 500 and not some like 401.

Is this the expected behavior ? I assume 401 would express more why this page can't be called.

Or do I have an error ? In the debugger I see that a securityexception is correctly thrown.

Is there a way to chjange this behvaior ? Does anyone know why this happens?

Answer 1

ClaimsPrincipalPermission throws a SecurityException. You maybe want to use something that playes nicer with web framework...

see here: http://leastprivilege.com/2012/10/26/using-claims-based-authorization-in-mvc-and-web-api/

Answer 2

The 500 error code does appear to be default response for SecurityExceptions.

The reasoning makes sense to me because ASP.NET doesn't necessarily know that its the user who is being denied access, all it knows is a SecurityException got thrown somewhere. Your website itself might have had insufficient permissions to do something, in which case a 500 should be expected.

Exception filters are a good way to analyze uncaught exceptions and figure out what HTTP code you want to return.

Answer 3

ClaimsPrincipalPermissionAttribute is invoked by CLR and throws SecurityException in case of role check fail. Check here for solution.