title: ASP.NET MVC 4 custom Authorize attribute - How to redirect unauthorized users to error page?
body: <p>I'm using a custom authorize attribute to authorize users' access based on their permission levels. I need to redirect unauthorized users (eg. user tries to delete an invoice without Delete acess level) to access denied page.</p>
  
  <p>The custom attribute is working. But in a case of unauthorized user access, nothing shown in the browser.</p>
  
  <p>Contoller Code.</p>
  
  <pre><code>public class InvoiceController : Controller
  {
      [AuthorizeUser(AccessLevel = "Create")]
      public ActionResult CreateNewInvoice()
      {
          //...
  
          return View();
      }
  
      [AuthorizeUser(AccessLevel = "Delete")]
      public ActionResult DeleteInvoice(...)
      {
          //...
  
          return View();
      }
  
      // more codes/ methods etc.
  }
  </code></pre>
  
  <p>Custom Attribute class code.</p>
  
  <pre><code>public class AuthorizeUserAttribute : AuthorizeAttribute
  {
      // Custom property
      public string AccessLevel { get; set; }
  
      protected override bool AuthorizeCore(HttpContextBase httpContext)
      {
          var isAuthorized = base.AuthorizeCore(httpContext);
          if (!isAuthorized)
          {                
              return false;
          }
  
          string privilegeLevels = string.Join("", GetUserRights(httpContext.User.Identity.Name.ToString())); // Call another method to get rights of the user from DB
  
          if (privilegeLevels.Contains(this.AccessLevel))
          {
              return true;
          }
          else
          {
              return false;
          }            
      }
  }
  </code></pre>
  
  <p>Appreciate if you can share your experience on this. </p>