{"action":"opened","issue":{"url":"https://api.github.com/repos/HangfireIO/Hangfire/issues/638","repository_url":"https://api.github.com/repos/HangfireIO/Hangfire","labels_url":"https://api.github.com/repos/HangfireIO/Hangfire/issues/638/labels{/name}","comments_url":"https://api.github.com/repos/HangfireIO/Hangfire/issues/638/comments","events_url":"https://api.github.com/repos/HangfireIO/Hangfire/issues/638/events","html_url":"https://github.com/HangfireIO/Hangfire/issues/638","id":169730232,"number":638,"title":"Incorrect status code when auth filter denies access","user":{"login":"pieceofsummer","id":2262364,"avatar_url":"https://avatars.githubusercontent.com/u/2262364?v=3","gravatar_id":"","url":"https://api.github.com/users/pieceofsummer","html_url":"https://github.com/pieceofsummer","followers_url":"https://api.github.com/users/pieceofsummer/followers","following_url":"https://api.github.com/users/pieceofsummer/following{/other_user}","gists_url":"https://api.github.com/users/pieceofsummer/gists{/gist_id}","starred_url":"https://api.github.com/users/pieceofsummer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pieceofsummer/subscriptions","organizations_url":"https://api.github.com/users/pieceofsummer/orgs","repos_url":"https://api.github.com/users/pieceofsummer/repos","events_url":"https://api.github.com/users/pieceofsummer/events{/privacy}","received_events_url":"https://api.github.com/users/pieceofsummer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-06T05:20:25Z","updated_at":"2016-08-06T05:20:25Z","closed_at":null,"body":"Current implementation of authorization filters returns HTTP 401 when access should be denied, which I'm pretty sure in incorrect behavior. And [it's not just me](http://stackoverflow.com/questions/3297048/403-forbidden-vs-401-unauthorized-http-responses).\r\n\r\nThe problem with incorrect status code is, when `IDashboardAuthorizationFilter` returns `false` (for example, because of the insufficient rights) for the *valid* and *authenticated* user, responding with `401 Unauthorized` would make HTTP stack automatically redirect to the login page, regardless of the user is already logged in. On the contrary, returning `403 Forbidden` will just display a page saying you're not allowed to access this resource. That's it.\r\n\r\nYou may even consider returning 401 or 403, depending on whether the user is authenticated.\r\n\r\nP.S. The interesting fact is, ASP.NET's legacy `AuthorizeAttribute` also returns 401 for already authenticated users, but it does so for historical reason."}}
{"actor":{"display_login":"pieceofsummer"}}