title: Authorize on Ajax call
body: <p>So I have MVC5 project and I have some ajax call when clicking a button, the controller it called have custom attribute I made so the framework can redirect someone to login page similar to non-ajax <code>[Authorize]</code>.</p>
  
  <p>Custom Attribute:</p>
  
  <pre><code>public class AjaxAuthorizeAttribute : AuthorizeAttribute
  {
      protected override void HandleUnauthorizedRequest(AuthorizationContext context)
      {
          if (context.HttpContext.Request.IsAjaxRequest()) {
              dynamic urlHelper = new UrlHelper(context.RequestContext);
              context.HttpContext.Response.StatusCode = 403;
  
              context.Result = new JsonResult {
                  Data = new {
                      Error = "NotAuthorized",
                      LogOnUrl = urlHelper.Action("Registration", "Membership")
                  },
                  JsonRequestBehavior = JsonRequestBehavior.AllowGet
              };
          } else {
              base.HandleUnauthorizedRequest(context);
          }
      }
  }
  </code></pre>
  
  <p>Controller :</p>
  
  <pre><code>[HttpPost()]
  [AjaxAuthorize()]
  public void Test()
  {
         //do something
  }
  </code></pre>
  
  <p>Javascript :</p>
  
  <pre><code>    //AJAX AUTHORIZE REDIRECT
      $(document).ajaxError(function (e, xhr) {
          if (xhr.status == 403) {
              var response = $.parseJSON(xhr.responseText);
              window.location = response.LogOnUrl;
          }
      });
  </code></pre>
  
  <p>it works fine in my localhost, however it doesn't work when I deployed it to my webserver. I did some checking and turned out the <code>xhr.responseText</code> in my jquery script have different result, here's the comparison :</p>
  
  <p>localhost :</p>
  
  <pre><code>{"Error":"NotAuthorized","LogOnUrl":"/Membership/Registration"} //correct output
  </code></pre>
  
  <p>webserver :</p>
  
  <pre><code>&lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"&gt;
  &lt;html xmlns="http://www.w3.org/1999/xhtml"&gt;
  &lt;head&gt;
  &lt;meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/&gt;
  &lt;title&gt;403 - Forbidden: Access is denied.&lt;/title&gt;
  &lt;style type="text/css"&gt;
  &lt;!--
  body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}
  fieldset{padding:0 15px 10px 15px;} 
  h1{font-size:2.4em;margin:0;color:#FFF;}
  h2{font-size:1.7em;margin:0;color:#CC0000;} 
  h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} 
  #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;
  background-color:#555555;}
  #content{margin:0 0 0 2%;position:relative;}
  .content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}
  --&gt;
  &lt;/style&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;div id="header"&gt;&lt;h1&gt;Server Error&lt;/h1&gt;&lt;/div&gt;
  &lt;div id="content"&gt;
   &lt;div class="content-container"&gt;&lt;fieldset&gt;
    &lt;h2&gt;403 - Forbidden: Access is denied.&lt;/h2&gt;
    &lt;h3&gt;You do not have permission to view this directory or page using the credentials that you supplied.&lt;/h3&gt;
   &lt;/fieldset&gt;&lt;/div&gt;
  &lt;/div&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>Any idea why this is happening?</p>