The offending issue was indeed the same as in [Always success on ajax post with HttpResponseMessage 401][1]. The response was returned successfully, but trapped a redirect to a form login



<pre><code><b>X-Responded-JSON</b>: {"status": 401, "headers": {"location":"http:\/\/localhost:50004\/Login?ReturnUrl=%2FClient"}}</code></pre>

Although that question doesn't seem to suggest a server side solution, instead simply relying on a parsing the error state on the client. **Brock Allen** suggests a server side fix in his post on [Using cookie authentication middleware with Web API and 401 response codes][2]:

> Normally when using cookie authentication middleware, when the server (MVC or WebForms) issues a 401, then the response is converted to a 302 redirect to the login page (as configured by the LoginPath on the [**CookieAuthenticationOptions**][3]). But when an Ajax call is made and the response is a 401, it would not make sense to return a 302 redirect to the login page. Instead you’d just expect the 401 response to be returned. Unfortunately this is not the behavior we get with the cookie middleware — the response is changed to a 200 status code with a JSON response body with a message:

>
    
>     {"Message":"Authorization has been denied for this request."}

>I’m not sure what the requirement was for this feature. To alter it, you must take over control of the behavior when there is a 401 unauthorized response by configuring a CookieAuthenticationProvider on the cookie authentication middleware:

>

>     app.UseCookieAuthentication(new CookieAuthenticationOptions
    {
       AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
       LoginPath = new PathString("/Account/Login"),
       Provider = new CookieAuthenticationProvider
       {
          OnApplyRedirect = ctx =>
          {
             if (!IsAjaxRequest(ctx.Request))
             {
                ctx.Response.Redirect(ctx.RedirectUri);
             }
         }
       }
    });

>Notice it handles the OnApplyRedirect event. When the call is not an Ajax call, we redirect. Otherwise, we do nothing which allows the 401 to be returned to the caller.

>The check for IsAjaxRequest is simply copied from a [**helper**][4] in the katana project:

>

>     private static bool IsAjaxRequest(IOwinRequest request)
    {
       IReadableStringCollection query = request.Query;
       if ((query != null) && (query["X-Requested-With"] == "XMLHttpRequest"))
       {
          return true;
       }
       IHeaderDictionary headers = request.Headers;
       return ((headers != null) && (headers["X-Requested-With"] == "XMLHttpRequest"));
    }

[1]: https://stackoverflow.com/q/20662608/1366033
[2]: https://brockallen.com/2013/10/27/using-cookie-authentication-middleware-with-web-api-and-401-response-codes/
[3]: https://brockallen.com/2013/10/24/a-primer-on-owin-cookie-authentication-middleware-for-the-asp-net-developer/
[4]: https://github.com/aspnet/AspNetKatana/blob/v3.1.0/src/Microsoft.Owin.Security.Cookies/Provider/DefaultBehavior.cs#L36

I'm submitting a standard [`$.ajax()`][1] request like this:



    $.ajax({
        type: "GET",
        url: myUrl
        success: function(data) {
            $("#replace").html(data)
        },
        error: function (data) {
            console.warn(data);
        }
    });

Or the same thing by attaching the handler to the [ajax promise][2] callbacks like this:



    $.ajax({
        type: "GET",
        url: myUrl
    })
    .done(function(data, status) {
        console.log(data);
    })
    .fail(function(data, status) {
        console.warn(status);
    });

In both cases, or when using [`$.ajaxError()` handler][3], the error/fail function is called when a HTTP status error is returned.

-------

In my ASP.NET MVC project, I'm trying to return the proper **HTTP Status Code**, both for semantic reasons and to be caught by the right client side handler.

**Attempt #1** - As suggested by [this answer][4] I've tried to return a [`HttpStatusCodeResult`][5] like this:



    protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
    {
        if (filterContext.HttpContext.Request.IsAjaxRequest())
        {
            filterContext.Result = new HttpStatusCodeResult(HttpStatusCode.Unauthorized, accessResult.AccessDeniedMessage);
            filterContext.HttpContext.Response.End();
        }
        else
        {
           base.HandleUnauthorizedRequest(filterContext);
        }
    }

**Attempt #2** - Alternatively, as suggested by [this answer][6], I've tried returning a `JsonResult` and also setting the [`Response.StatusCode`][7]



    filterContext.HttpContext.Response.StatusCode = (int)HttpStatusCode.Unauthorized;
    filterContext.Result = new JsonResult()
    {
        Data = new { Error = "Unauthorized User" },
        JsonRequestBehavior = JsonRequestBehavior.AllowGet
    };
    filterContext.HttpContext.Response.End();

In both cases, the response still comes back as **200 OK**


[![AJAX Status Code Screenshot][8]][8]


### Questions:

* Am I correct about the semantics that I should be returning an AJAX response with a Unauthorized Status Code?
* Is there somewhere else to set this value that I need to do also?
* Is there some server level setting to allow non-200 status codes to be returned?

---

This question on [Always success on ajax post with HttpResponseMessage 401][9] seems to be running into the same error, but doesn't propose a server side solution, instead just allowing the OK error status code and scraping the response to determine if an error occurred.


  [1]: http://api.jquery.com/jquery.ajax/
  [2]: http://api.jquery.com/jquery.ajax/#jqXHR
  [3]: http://api.jquery.com/ajaxerror/
  [4]: https://stackoverflow.com/a/8702126/1366033
  [5]: https://msdn.microsoft.com/en-us/library/System.Web.Mvc.HttpStatusCodeResult "System.Web.Mvc.HttpStatusCodeResult"
  [6]: https://stackoverflow.com/a/11085769/1366033
  [7]: https://msdn.microsoft.com/en-us/library/System.Web.HttpResponse.StatusCode "System.Web.HttpResponse.StatusCode"
  [8]: https://i.stack.imgur.com/jEy2K.png
  [9]: https://stackoverflow.com/q/20662608/1366033