如何阻止ASP.NET授权特性重定向到拒绝访问路径

ASP.NET MVC（传统框架）方案 #

直接自定义一个授权特性，替换默认的[Authorize]，在无权限时直接返回视图而非重定向：

public class CustomAuthorizeAttribute : AuthorizeAttribute
{
    protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
    {
        // 用户已登录但权限不足时，返回自定义403视图
        if (filterContext.HttpContext.User.Identity.IsAuthenticated)
        {
            filterContext.Result = new ViewResult
            {
                ViewName = "AccessDenied", // 你的自定义视图名称
                ViewData = filterContext.Controller.ViewData,
                TempData = filterContext.Controller.TempData
            };
            filterContext.HttpContext.Response.StatusCode = 403;
        }
        else
        {
            // 用户未登录的情况，保留默认登录重定向逻辑（可按需修改）
            base.HandleUnauthorizedRequest(filterContext);
        }
    }
}

使用时，把原来的[Authorize(Roles = "Administrator")]换成[CustomAuthorize(Roles = "Administrator")]即可。记得在Views/Shared或对应控制器的视图文件夹下创建AccessDenied.cshtml自定义视图。

ASP.NET Core方案 #

方法1：自定义授权结果处理器 #

实现IAuthorizationMiddlewareResultHandler来拦截403禁止响应，直接返回视图：

public class CustomAuthorizationResultHandler : IAuthorizationMiddlewareResultHandler
{
    private readonly AuthorizationMiddlewareResultHandler _defaultHandler = new();

    public async Task HandleAsync(RequestDelegate next, HttpContext context, AuthorizationPolicy policy, PolicyAuthorizationResult authorizeResult)
    {
        if (authorizeResult.Forbidden && context.User.Identity.IsAuthenticated)
        {
            context.Response.StatusCode = StatusCodes.Status403Forbidden;
            // 渲染自定义403视图（需实现视图渲染服务，或直接返回静态HTML）
            var viewRenderer = context.RequestServices.GetRequiredService<IViewRenderer>();
            var viewContent = await viewRenderer.RenderViewToStringAsync("AccessDenied");
            await context.Response.WriteAsync(viewContent);
            return;
        }

        // 其他情况走默认处理逻辑
        await _defaultHandler.HandleAsync(next, context, policy, authorizeResult);
    }
}

然后在Program.cs中注册这个处理器：

builder.Services.AddSingleton<IAuthorizationMiddlewareResultHandler, CustomAuthorizationResultHandler>();

方法2：自定义授权处理类（针对策略授权） #

如果用的是基于策略的授权，可以创建自定义授权处理器：

// 定义授权要求
public class AdminRoleRequirement : IAuthorizationRequirement { }

// 实现授权处理器
public class AdminRoleAuthorizationHandler : AuthorizationHandler<AdminRoleRequirement>
{
    private readonly IHttpContextAccessor _httpContextAccessor;
    private readonly IViewRenderService _viewRenderService;

    public AdminRoleAuthorizationHandler(IHttpContextAccessor httpContextAccessor, IViewRenderService viewRenderService)
    {
        _httpContextAccessor = httpContextAccessor;
        _viewRenderService = viewRenderService;
    }

    protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, AdminRoleRequirement requirement)
    {
        if (!context.User.IsInRole("Administrator"))
        {
            var httpContext = _httpContextAccessor.HttpContext;
            if (httpContext != null && context.User.Identity.IsAuthenticated)
            {
                httpContext.Response.StatusCode = 403;
                var viewContent = await _viewRenderService.RenderViewToStringAsync("AccessDenied");
                await httpContext.Response.WriteAsync(viewContent);
                context.Succeed(requirement); // 标记为成功，避免触发默认重定向
                return;
            }
        }

        context.Succeed(requirement);
    }
}

在Program.cs中注册策略和处理器：

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("AdminOnly", policy =>
        policy.Requirements.Add(new AdminRoleRequirement()));
});
builder.Services.AddScoped<IAuthorizationHandler, AdminRoleAuthorizationHandler>();

使用时在控制器或Action上标记[Authorize(Policy = "AdminOnly")]即可。

注：上述代码中的IViewRenderer是自定义视图渲染服务，用于在中间件/处理器中把Razor视图转为字符串。如果是MVC项目，也可以通过注入IViewResultExecutor实现，或直接返回静态HTML内容。

内容的提问来源于stack exchange，提问作者iKingNinja