ASP.NET MVC Authorize Attribute with Access Denied Page →
I struggled to get the ASP.NET MVC Authorize attribute to redirect to an “Access Denied” page when the user was not in the specified role. I was using windows authentication and no matter what I set in the web config customErrors section (which was recommended) the user would always be prompted to enter a username and password instead. I found this stack overflow answer that suggests using a custom attribute. It’s the only thing I’ve found that works.
