c# - Forms Authentication: How to handle unauthorized authenticated user -

i trying setup basic forms authentication example.

it correctly redirecting unauthenticated users login page , on submit verifying credentials , if correct calling:

formsauthentication.redirectfromloginpage(username.text, false); 

if user 1 named in authorization section page. if not bounces them login page no error.

how can redirect correctly authenticated unauthorized users specific error page or detect authorization error display error message on login page bounce back?

here web.config

   <authentication mode="forms">       <forms name=".aspxauth" loginurl="/forms/login" />     </authentication>     <authorization>       <deny users="?" />       <allow users="username1, username2" />       <deny users="*" />     </authorization> 

update:

based on answers / comments / research i've got 2 working solutions.

1. put following in page_load method of login form:

       if (request.isauthenticated && !string.isnullorempty(request.querystring["returnurl"]))     {         // unauthorized, authenticated request...          response.redirect("failedauthorization.aspx");     } 

or

2. put following in global.aspx file:

   protected void application_endrequest(object sender, eventargs e) {     if (response.statuscode == 401)     {         //use built in 403 forbidden response         response.statuscode = 403;          //or redirect custom page         //response.redirect("failedauthorization.aspx");     } }  protected void application_authenticaterequest(object sender, eventargs e) {     if (request.isauthenticated)     {         // requires asp.net >= 4.5         response.suppressformsauthenticationredirect = true;     } } 

thank this!

unfortunately, 1 of things asp.net continually gets wrong. though ms , .net framework team full understand difference between authentication , authorization, still insist on treating unauthorized unauthenticated. don't know why is.

this quirk of formsauthentication module handler, in returns 401 unauthorized instead of 403 forbidden. (it doesn't http standard confuses authentication authorization in manner).

this not can override, recourse checking in login page see if logged in, , if redirected... it's not foolproof, it's 1 way handle it.

you don't version of .net you're using, if using .net 4.5 have option, use suppressformsauthenticationredirect option in article:

forms authentication: disable redirect login page