how to return 401 in razor pages?

Question

how to return status code in razor pages not redirect?

builder.Services.AddRazorPages().AddRazorPagesOptions(options =>
{
    options.Conventions.AuthorizeFolder("/");
    options.Conventions.AllowAnonymousToPage("/Login");
});

and I create a controller

[Authorize]
public class InfoController:ControllerBase
{
public string GetIndex()
{
     return "OOO";
}
}```

If I call the api it will redirect to /login and I want it return status code = 401 

Answer 1

Hi @打玻璃

If you are using Asp.net core identity or cookie authentication, to prevent the Web API redirect to the Login page and show the 401 error, you can override the Cookie Authentication's OnRedirectToLogin event:

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie(options =>
{
    options.Events.OnRedirectToAccessDenied =
    options.Events.OnRedirectToLogin = c =>
    {
        c.Response.StatusCode = StatusCodes.Status401Unauthorized;
        return Task.FromResult<object>(null);
    };
});

After that, when you access the protected action method (the user is not authenticated), it will show the 401 error. The result as below:

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Best regards,
Dillion

Answer 2

The code is functioning as expected since InfoController is an MVC controller not Web API.
Web API example.

    [Route("api/[controller]")]
    [ApiController]
    public class ValuesController : ControllerBase
    {
        // GET: api/<ValuesController>
        [HttpGet]
        public IActionResult Get()
        {
            return Unauthorized();
        }

Answer 3

please add [Authorize] and it redirect not return unauthorized.

Correct! That's how MVC controller fundamentally work. MVC controller redirect to a login page when the request is not authorized because MVC is a framework for creating user interfaces. The login page lets the user know they need to login.

A Web API controller returns a 401 since there is no user interface. The 401 lets the caller know the request was not authorized. Create a Web API controller rather than an MVC controller if you want this behavior. Keep in mind, tokens are used to authorize Web API requests while MVC uses an authentication cookie.

    [Route("api/[controller]")]
    [ApiController]
    public class ValuesController : ControllerBase
    {
        // GET: api/<ValuesController>
        [HttpGet]
        [Authorize]
        public IActionResult Get()
        {
            return Ok("Hello World");
        }

If you want to change the behavior of MVC then write a custom authorize attribute or filter. Please read the official documentation. Introduction to authorization in ASP.NET Core