View is rendered even the request is unauthorized - asp.net-mvc

Question

I have an MVC app where I have an Admin area. When user is not logged in I'm redirecting the request to login page with custom AuthorizeAttribute.
public class UserAuthorizeAttribute : AuthorizeAttribute
{
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
var user = AdminGlobals.CurrentUser;
if (user == null || !user.IsActive)
{
return false;
}
return true;
}
protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
{
var user = AdminGlobals.CurrentUser;
var context = HttpContext.Current;
//Do not redirect if the request is already redirecting
if (context.Response.IsRequestBeingRedirected) return;
if (user == null || !user.IsActive)
{
context.Response.Redirect("/login", true);
}
else
{
context.Response.Redirect("/unauthorized", true);
}
}
}
Controller and action:
[UserAuthorize]
public ActionResult Index()
{
return View();
}
And in the view I have:
Hello #AdminGlobals.CurrentUser.Title
When the application is in debug mode I'm having NullReferenceExceptions for inside the view and also the layout page since it tries to use same variable #AdminGlobals.CurrentUser which is null. I know I can easily prevent this but I cannot understand why the view is rendered when the request is not authorized. Is it possible to use RedirectToAction inside AuthorizeAttribute to prevent rendering of the view?

Answer 1

I'm not sure that using Response in a filter is the way to go. Typically, you leverage the filterContext to perform your redirect. For example:
protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
{
var user = AdminGlobals.CurrentUser;
var context = filterContext.HttpContext;
//Do not redirect if the request is already redirecting
if (context.Response.IsRequestBeingRedirected) return;
var routeData = new RouteValueDictionary(new {
controller = "Home",
action = "Unauthorized"
});
if (user == null || !user.IsActive)
{
routeData = new RouteValueDictionary(new { controller = "Home", action = "Login" });
}
filterContext.Result = new RedirectToRouteResult("Default", routeData);
}
I'm assuming from your code that both actions are on the HomeController; otherwise, update the controller name to the correct value.
"Default," in the constructor for the RedirectToRouteResult object, is the name of the route in your RouteConfig that you want to be applied.
Also, use the HttpContext from the filerContext.