Abp: Requesting to an API without authorization is redirected to Login page

[gdlcf88]

I read the document:

Client explicitly accepts the application/json content type (via accept HTTP header).

The ABP version: 3.0.1
The startup template: app with MVC-UI

Configurations in WebModule is following the startup template.

Other information:

• Requesting with XMLHttpRequest = X-Requested-With does not redirect to the login page, but get empty content with 401 status code.

[gdlcf88]

I see https://github.com/abpframework/abp/issues/2643#issuecomment-574940166, it explained the reason.

Does it mean I must manually create controllers?

[wakuflair]

Is there a convenient way to configure the authorization for all the auto controller methods? Something like

ConfigureAutoController(opt => opt.UseAnonymousForAll())

@maliming

[maliming]

AutoController depends on the [Authorize] attribute on the application service.

[wakuflair]

The [Authorize] returns 401 if authorization failed, but AutoController redirects to the login page.

It's hard for mobile or other clients that only using API as a server due to this behaviour.

[maliming]

This is the behavior of asp net core unless we use other methods to implement auto controllers.

https://docs.microsoft.com/en-us/aspnet/core/security/authorization/limitingidentitybyscheme?view=aspnetcore-3.1

[maliming]

See https://github.com/abpframework/abp/issues/5235#event-3716370525

[yincen]

The [Authorize] returns 401 if authorization failed, but AutoController redirects to the login page.

It's hard for mobile or other clients that only using API as a server due to this behaviour.

This issue has been added to the milestone. See https://github.com/abpframework/abp/milestone/39