---
title: Handle an unauthorized request
summary: Log a denied authorization attempt and redirect the user to the error page.
status: draft
owner: SAIF Documentation
last_reviewed: 2026-09-17
library: SAIF.Framework.Web.Mvc
reference_type: package
operation_id: OP-10
trigger: `AuthorizeCore` returned `false`
---

# Handle an unauthorized request

Log a denied authorization attempt and redirect the user to the error page. Trigger: `AuthorizeCore` returned `false`.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-10 |
| **Trigger** | `AuthorizeCore` returned `false` |
| **Inputs** | `AuthorizationContext`; injected `ILogService` and `IEnvironmentService` |
| **Outputs** | Logged `SecurityException`; `RedirectResult` to the error page |
| **Primary components** | `SaifAuthorizeAttribute.HandleUnauthorizedRequest(AuthorizationContext)` |
| **Entry point** | `src/Web.Mvc/ActionFilters/SaifAuthorizeAttribute.cs` |

## Steps

1. `Enforce.ArgumentNotNull` on `filterContext`, `LogService`, and `EnvironmentService` ([BR-01](../business-rules.md#br-01-guarded-arguments-reject-null-or-empty-input), [BR-15](../business-rules.md#br-15-authorization-filter-requires-its-injected-services)).
2. Build context text `"User: {EnvironmentService.UserId()}{NewLine}Page: {Request.Url}"`.
3. Call `LogService.LogException(applicationName, controllerAndActionName, state, new SecurityException("The user '{_userId}' is not authorized for this view."))` ([BR-19](../business-rules.md#br-19-authorization-denials-are-logged-as-a-security-exception)).
4. Set `filterContext.Result = new RedirectResult("//saifonline/weberror/processerror.aspx?MSG=Not%20Authorized")` — a hard-coded literal rather than `Constants.ErrorUrl` ([BR-20](../business-rules.md#br-20-denied-users-are-redirected-to-the-standard-error-page)).

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([AuthorizeCore returned false])
	Guard[Guard filterContext/services]
	Build[Build context text]
	Log[LogService.LogException SecurityException]
	Redir[Set Result to RedirectResult]
	EndOk(["Denied, redirected"])
	Start --> Guard
	Guard --> Build
	Build --> Log
	Log --> Redir
	Redir --> EndOk
```

## Failure and edge-case behavior

- No unexpected failure paths beyond argument-guard exceptions and delegated dependency behavior were identified for this operation.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

## Sources
- `src/Web.Mvc/ActionFilters/SaifAuthorizeAttribute.cs`