title: MVC 4 AuthorizeAttribute.HandleUnauthorizedRequest ViewResult - infinite loop
body: <p>i've stepped through my code a million times and can't find a problem with my implementation.. </p>
  
  <p>in custom AuthorizeAttribute i overwrote 2 methods </p>
  
  <pre><code>    protected override bool AuthorizeCore(HttpContextBase httpContext)
      {
          if (!httpContext.Request.IsAuthenticated)
              return false;
          var routeData = httpContext.Request.RequestContext.RouteData;
          var ctrl = routeData.Values["controller"].ToString();
          var action = routeData.Values["action"].ToString();
          var user = httpContext.User.Identity.Name;
          _logger.Info("[logging all the details]");
          return ctrl == "SomeController";
      }
  
      protected override void HandleUnauthorizedRequest(AuthorizationContext ctx)
      {
          ctx.Result = new ViewResult  { ViewName = "Unauthorized" };
          // base.HandleUnauthorizedRequest(ctx);
       }
  </code></pre>
  
  <p>the authorization logic is mocked to return false only on specific controller, and i've stepped through this to verify it's working correctly. </p>
  
  <p>above code will cause infinite loop.  in my log i can see that line hit 666 times (coincidence?) .. </p>
  
  <p>if i do call base.HandleUnauthorizedRequest(ctx), all i get is a blank page. so i reflected what the base does, and it's this </p>
  
  <pre><code>filterContext.Result = new HttpUnauthorizedResult();
  </code></pre>
  
  <p>so this explains why it renders a blank page instead of redirecting to Unauthorized.cshtml.  what i'm not sure about, is why does it go into an infinite loop if i don't call the base. </p>
  
  <p>p.s.</p>
  
  <p>i've verified that if i put the wrong Unauthorized view it will error out (but still hangs indefinitely)</p>
  
  <pre><code> System.InvalidOperationException: The view 'Unauthorized11' or its master was not found or no view engine supports the searched locations
  </code></pre>