I have an ASP.NET MVC3 application with Windows Authentication deployed to IIS6. When an authenticated user clicks on a link that they are not authorized to view, they are prompted to enter their username and password (in a browser dialog, not a page), as expected.
However, after clicking Cancel or entering invalid credentials three times, instead of seeing the a 401 Unauthorized page, I see a blank white page.
Looking at Fiddler, there are three requests/responses after clicking Cancel. Here are the response summaries and headers:
ASP.NET Access is denied message (401.2)
HTTP/1.1 401 Unauthorized Date: Fri, 20 Jul 2012 14:34:21 GMT Server: Microsoft-IIS/6.0 WWW-Authenticate: Negotiate WWW-Authenticate: NTLM X-Powered-By: ASP.NET X-AspNet-Version: 4.0.30319 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 1701 Proxy-Support: Session-Based-Authentication
IIS You are not authorized to view this page (401.1)
HTTP/1.1 401 Unauthorized Content-Length: 1539 Content-Type: text/html Server: Microsoft-IIS/6.0 WWW-Authenticate: NTLM TlRMTVNTUAACAAAADAAMADgAAAAF... (omitted for brevity) X-Powered-By: ASP.NET Date: Fri, 20 Jul 2012 14:34:21 GMT Proxy-Support: Session-Based-Authentication
Empty response
HTTP/1.1 401 Unauthorized Date: Fri, 20 Jul 2012 14:34:21 GMT Server: Microsoft-IIS/6.0 WWW-Authenticate: Negotiate WWW-Authenticate: NTLM X-Powered-By: ASP.NET X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 3.0 Cache-Control: private Content-Length: 0 Proxy-Support: Session-Based-Authentication
How do I get this to display a 401 error page?
Update 1:
Here is my web.config errors section.
<customErrors mode="RemoteOnly" defaultRedirect="~/Error" />
I'm also using HandleErrorAttribute.
I suspect that IIS is returning the blank page rather than ASP.NET, but I'm not sure how to prove that.
Update 2:
This is interesting. If I refresh the blank page, I see the ASP.NET Access is Denied message.