I am trying to implement a simple API with cookie authentication. I would like to have 403 and 401 when user is unauthorized and 401 when he is unauthenticated accordingly.

When I am trying to access the protected endpoint for which I don’t have enough rights, I get into a recursion.

So basically if I am returning a http 403, I am getting into recursion.

Here is a very simple repo to reproduce:

The flow is login -> try to access GetAuthorizedDataAdmins (it requires to have role “Admins”) we only have “Admin”.

Put the brake point on forbidden endpoint and you will see the recursion.

Am I doing something wrong or is it a bug?

It is so easy to reproduce that I cannot believe wasn’t fixed before.

Repo to reproduce