ASP.NET MVC redirect to an access denied page using a custom role provider

Question

I\'m creating a custom role provider and I set a Authorize attribute specifying a role in my controller and it\'s working just fine, like this:

[Authorize(Ro         


        

Answer 1

I had similar issue. No matter what role I had, I was always redirected to LogIn page instead of AccessDenied. The fix was unbelievably easy, but it might not work in all cases. So it turned out, that I had wrong order in Startup.cs of these two lines:

app.UseAuthentication();
app.UseAuthorization();

Make sure if app.UseAuthentication(); is BEFORE app.UseAuthorization();

In other words, ask "Who are you?" first, and then "Are you allowed here?", not the other way.