Authorize attributes/filters with criteria should not use 401 for authenticated users

[Tratcher]

Related:
https://katanaproject.codeplex.com/discussions/547633#post1253618
#432

Consider Authorize attributes and authorization filters that restrict with a specific criteria.
[Authorize(Roles = "Developers")]

The current and classic behavior of authorization filters and attributes is to send a 401 response if their criteria aren't met. If there is no authenticated user, this is entirely correct as it will trigger the authentication flow. However, if there is already an authenticated user, sending a 401 just puts them into an infinite authentication loop.

Possible solutions:

• If the user used the wrong auth type, a specific challenge for the required auth type should be issued.
• Sending a 403 (Forbidden) would inform them that they were authenticated, but they still lack the necessary permissions for the given resource. The infrastructure may choose to redirect 403s to a detailed error page.

[Tratcher]

http://stackoverflow.com/questions/25595548/using-the-mvc-authorize-attribute-with-roles-using-azure-active-directory-owin

[yishaigalatzer]

@HaoK @blowdart is this a thing with the new design?

[HaoK]

Fixed