{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/720","repository_url":"https://api.github.com/repos/aspnet/Security","labels_url":"https://api.github.com/repos/aspnet/Security/issues/720/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/720/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/720/events","html_url":"https://github.com/aspnet/Security/issues/720","id":136955242,"number":720,"title":"Receiving HTTP 401 when should be receiving 403","user":{"login":"chadly","id":1761510,"avatar_url":"https://avatars.githubusercontent.com/u/1761510?v=3","gravatar_id":"","url":"https://api.github.com/users/chadly","html_url":"https://github.com/chadly","followers_url":"https://api.github.com/users/chadly/followers","following_url":"https://api.github.com/users/chadly/following{/other_user}","gists_url":"https://api.github.com/users/chadly/gists{/gist_id}","starred_url":"https://api.github.com/users/chadly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chadly/subscriptions","organizations_url":"https://api.github.com/users/chadly/orgs","repos_url":"https://api.github.com/users/chadly/repos","events_url":"https://api.github.com/users/chadly/events{/privacy}","received_events_url":"https://api.github.com/users/chadly/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/aspnet/Security/labels/bug","name":"bug","color":"fc2929"}],"state":"closed","locked":false,"assignee":{"login":"HaoK","id":6537861,"avatar_url":"https://avatars.githubusercontent.com/u/6537861?v=3","gravatar_id":"","url":"https://api.github.com/users/HaoK","html_url":"https://github.com/HaoK","followers_url":"https://api.github.com/users/HaoK/followers","following_url":"https://api.github.com/users/HaoK/following{/other_user}","gists_url":"https://api.github.com/users/HaoK/gists{/gist_id}","starred_url":"https://api.github.com/users/HaoK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HaoK/subscriptions","organizations_url":"https://api.github.com/users/HaoK/orgs","repos_url":"https://api.github.com/users/HaoK/repos","events_url":"https://api.github.com/users/HaoK/events{/privacy}","received_events_url":"https://api.github.com/users/HaoK/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/aspnet/Security/milestones/14","html_url":"https://github.com/aspnet/Security/milestones/1.0.0-rc2","labels_url":"https://api.github.com/repos/aspnet/Security/milestones/14/labels","id":1367318,"number":14,"title":"1.0.0-rc2","description":null,"creator":{"login":"Eilon","id":202643,"avatar_url":"https://avatars.githubusercontent.com/u/202643?v=3","gravatar_id":"","url":"https://api.github.com/users/Eilon","html_url":"https://github.com/Eilon","followers_url":"https://api.github.com/users/Eilon/followers","following_url":"https://api.github.com/users/Eilon/following{/other_user}","gists_url":"https://api.github.com/users/Eilon/gists{/gist_id}","starred_url":"https://api.github.com/users/Eilon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Eilon/subscriptions","organizations_url":"https://api.github.com/users/Eilon/orgs","repos_url":"https://api.github.com/users/Eilon/repos","events_url":"https://api.github.com/users/Eilon/events{/privacy}","received_events_url":"https://api.github.com/users/Eilon/received_events","type":"User","site_admin":false},"open_issues":9,"closed_issues":60,"state":"open","created_at":"2015-10-20T22:41:25Z","updated_at":"2016-02-29T21:29:15Z","due_on":null,"closed_at":null},"comments":8,"created_at":"2016-02-27T19:06:23Z","updated_at":"2016-03-01T18:22:52Z","closed_at":"2016-02-29T21:29:15Z","body":"Logging a bug per @blowdart 's suggestion on the [last comment here](http://stackoverflow.com/a/31465227/316108) (also [discussed here](http://stackoverflow.com/questions/35656828/return-http-403-using-authorize-attribute-in-asp-net-mvc-6) with @danludwig)\r\n\r\nWhen using the `Authorize` attribute, MVC 6 is returning HTTP `401` when I believe it should be returning a `403`. Here are repro steps:\r\n\r\n```cs\r\n//fake middleware to always authenticate a test user\r\npublic class TestAuthMiddleware\r\n{\r\n\treadonly RequestDelegate next;\r\n\r\n\tpublic TestAuthMiddleware(RequestDelegate next)\r\n\t{\r\n\t\tthis.next = next;\r\n\t}\r\n\r\n\tpublic async Task Invoke(HttpContext context)\r\n\t{\r\n\t\tIEnumerable<Claim> claims = new Claim[]\r\n\t\t{\r\n\t\t\tnew Claim(ClaimTypes.Name, \"homer.simpson\"),\r\n\t\t\tnew Claim(ClaimTypes.Email, \"homer@simpsons.com\"),\r\n\t\t\tnew Claim(\"Permission\", \"eat donuts\")\r\n\t\t};\r\n\r\n\t\tvar identity = new ClaimsIdentity(claims, authenticationType: \"testing\", nameType: ClaimTypes.Name, roleType: \"Permission\");\r\n\t\tvar principal = new ClaimsPrincipal(identity);\r\n\r\n\t\tcontext.User = principal;\r\n\r\n\t\tawait next(context);\r\n\t}\r\n}\r\n\r\n//controller which requires authorization for the permission \"eat donuts\"\r\npublic class TestController : Controller\r\n{\r\n\t[HttpGet]\r\n\t[Route(\"\")]\r\n\t[Authorize(Roles = \"eat donuts\")]\r\n\tpublic object Index()\r\n\t{\r\n\t\treturn new { hello = \"world\", username = User.Identity.Name };\r\n\t}\r\n}\r\n```\r\n\r\nWhen hitting the root endpoint, it will correctly return:\r\n\r\n```json\r\n{\r\n  \"hello\": \"world\",\r\n  \"username\": \"homer.simpson\"\r\n}\r\n```\r\n\r\nIf you comment out the line `context.User = principal` in the middleware, hitting the controller will correctly return a `401` (since no user is authenticated). If, however, you comment out the line `new Claim(\"Permission\", \"eat donuts\")` in the middleware, it will still return a `401` when it should be returning a `403` (since the user is authenticated, he just doesn't have permission).\r\n\r\nUsing Microsoft.AspNet.Mvc v6.0.0-rc1-final"},"comment":{"url":"https://api.github.com/repos/aspnet/Security/issues/comments/190841250","html_url":"https://github.com/aspnet/Security/issues/720#issuecomment-190841250","issue_url":"https://api.github.com/repos/aspnet/Security/issues/720","id":190841250,"user":{"login":"blowdart","id":796298,"avatar_url":"https://avatars.githubusercontent.com/u/796298?v=3","gravatar_id":"","url":"https://api.github.com/users/blowdart","html_url":"https://github.com/blowdart","followers_url":"https://api.github.com/users/blowdart/followers","following_url":"https://api.github.com/users/blowdart/following{/other_user}","gists_url":"https://api.github.com/users/blowdart/gists{/gist_id}","starred_url":"https://api.github.com/users/blowdart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blowdart/subscriptions","organizations_url":"https://api.github.com/users/blowdart/orgs","repos_url":"https://api.github.com/users/blowdart/repos","events_url":"https://api.github.com/users/blowdart/events{/privacy}","received_events_url":"https://api.github.com/users/blowdart/received_events","type":"User","site_admin":false},"created_at":"2016-03-01T18:22:51Z","updated_at":"2016-03-01T18:22:51Z","body":"I believe that's MVC at that point.\r\n\r\nFor test users what I usually end up doing is using cookie auth and dropping the cookie - https://github.com/blowdart/AspNetAuthorizationWorkshop/blob/master/src/Step%202%20-%20Authorize%20All%20The%20Things/Controllers/AccountController.cs"}}