title: MVC OnAuthorization redirect to controller/action with model
body: <p><strong>UPDATE</strong>
  Not a duplicate as per above as that question routes to an explicit view, not a controller/action</p>
  
  <p>I am using a custom authorisation (at controller level) to ensure that a user can only access specific functions of an application (held in an external access control system). </p>
  
  <p>Below is the <code>AuthorizeAttribute</code> class</p>
  
  <pre><code>public class MyCustomAuth : AuthorizeAttribute
  {
      public override void OnAuthorization(AuthorizationContext filterContext)
      {
          string ctrl = (string)filterContext.RouteData.Values["controller"];
  
          bool isAuth = GetAuthorizedFunctions(HttpContext.Current.User).Any(f =&gt; f.Controller.Equals(ctrl, StringComparison.InvariantCultureIgnoreCase));
          if (!isAuth)
          {
              filterContext.Result = new RedirectToRouteResult(new RouteValueDictionary(new { controller = "Contact", action = "Index", AuthMsg = "Sorry, unauthorized" }));
          }
      }
  }
  </code></pre>
  
  <p>Bascially, if the user requests a function that they are not authorised to access, then I redirect then to the "Contact" page to show a suitable message.</p>
  
  <p>However, in the above, the AuthMessage is encoded into the URL string..</p>
  
  <p><code>http://localhost/HotelRequests/Contact?AuthMsg=Sorry%2C%20unauthorized</code></p>
  
  <p>How can I pass this message without it being shown in the URL, preferable as a ViewModel required for the Contact page.</p>