Returning HTTP 403 in a WebAPI method

Question

How do I return an HTTP 403 from a WebAPI method? I've tried throwing an HttpResponseException with HttpStatusCode.Forbidden, and I've tried

return request.CreateErrorResponse(HttpStatusCode.Forbidden, pEx);

Neither of which work. Both ALWAYS return an HTTP 200. What am I missing? It has to be something simple but I don't see it.

Have you tried the solution here? stackoverflow.com/a/10658604/163495 — Richard
– Richard, Commented Jun 19, 2013 at 21:04
could you share more code...we are unable to reproduce your issue — Kiran
– Kiran, Commented Jun 19, 2013 at 21:52

Micah Switzer · Accepted Answer · 2017-07-14 09:57:57Z

3

You might have a problem with your routing configuration. Below is a working sample. Put it in your controller and see if it works. If it doesn't, check your routing with a diagnostic tool (i.e. Cobisi Routing Assistant).

public HttpResponseMessage GetSomeString(int id)
{
    // This method is not allowed!
    return this.Request.CreateErrorResponse(HttpStatusCode.Forbidden, "This method is not allowed!");
}

edited Jul 14, 2017 at 9:57

Micah Switzer

1541 silver badge11 bronze badges

answered Jun 20, 2013 at 10:41

Teoman Soygul

25.8k6 gold badges73 silver badges84 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

jeff.eynon Over a year ago

Teoman, that does work. Oddly, it seems to be some sort of interaction with DotNetOpenAuth. My web api is an endpoint secured with DotNetOpenAuth. If I call my method without going through the DotNetOpenAuth verification, I get a 403. However, If I call it by going through DotNetOpenAuth verification, and the verificatoin fails (which is the situation I want to return a 403 with), the same line of code you suggested runs, however no matter what I get a 200 back. So I guess I'll have to re-post with a dotnetopenauth tag.

user3953989 Over a year ago

Getting invalid cast from HttpResponseMessage to String

GreyCloud Over a year ago

how to fix the invalid cast to string?

huer12 Over a year ago

you always can throw a HttpResponseException(HttpStatusCode.Forbidden) instead.

Collectives™ on Stack Overflow

Returning HTTP 403 in a WebAPI method

1 Answer 1

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related