I had the same issue with setting StatusCode
and then Response.End
in HandleUnauthorizedRequest
method of AuthorizeAttribute
var ctx = filterContext.HttpContext;
ctx.Response.StatusCode = (int)HttpStatusCode.Forbidden;
ctx.Response.End();
If you are using .NET 4.5+, add this line before Response.StatusCode
filterContext.HttpContext.Response.SuppressFormsAuthenticationRedirect = true;
If you are using .NET 4.0, try SuppressFormsAuthenticationRedirectModule.