 <p>You can create a simple authorization attribute filter (extend the AuthorizeAttribute class) and use it for your access control. Then try something like this:</p> <pre><code>protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext) { if (filterContext.HttpContext.Request.IsAjaxRequest() || string.Compare("GET", filterContext.HttpContext.Request.HttpMethod, true) != 0) { // Returns 403. filterContext.Result = new HttpStatusCodeResult((int)HttpStatusCode.Forbidden); } else { // Returns 401. filterContext.Result = new HttpUnauthorizedResult(); } } </code></pre> <p>The effect is that, POST and AJAX requests will always receive a 403 response which makes it easier for you to handle your ajax submits in javascript. As for the non-ajax posts, it doesn't really matter what the response is because your user shouldn't have got his hands on the submit form in the first place :)</p> <p>As for the other requests, the method returns 401 that the formsAuthentiction module will pick up and then redirect your response to the login page.</p>