Copied to clipboard

Flag this post as spam?

This post will be reported to the moderators as potential spam to be looked at


  • Emil Christiansen 66 posts 148 karma points
    Oct 02, 2015 @ 11:49
    Emil Christiansen
    1

    Problems with routing and the Developer section - 401 Authorization has been denied for this request

    Hi

    We are having problems accessing the developer section in Umbraco.

    We are running on a Umbraco 7.3 and get a 401 error:

    "{"Message":"Authorization has been denied for this request."}"
    

    The following requests throws a 401 (From Fiddler):

    • /custom-api/ExamineManagementApi/GetIndexerDetails
    • /custom-api/ExamineManagementApi/GetSearcherDetails
    • /custom-api/XmlDataIntegrity/CheckContentXmlTable
    • /custom-api/XmlDataIntegrity/CheckMediaXmlTable
    • /custom-api/XmlDataIntegrity/CheckMembersXmlTable

    When we try to access the developer section - we end up on the Umbraco login-screen. The problem only occurs on the developer section.

    In the 'OnApplicationStarting' eventhandler we have the following route registrations:

            RouteTable.Routes.MapHttpRoute("custom-api-ApiWithAction", "custom-api/{controller}/{action}/{id}", new { id = RouteParameter.Optional });
            RouteTable.Routes.MapHttpRoute("custom-api-ApiWithId", "custom-api/{controller}/{id}", new { id = RouteParameter.Optional });
            RouteTable.Routes.MapHttpRoute("custom-api-ApiGet", "custom-api/{controller}", new { action = "Get" }, new { httpMethod = new HttpMethodConstraint("GET") });
            RouteTable.Routes.MapHttpRoute("custom-api-ApiPost", "custom-api/{controller}", new { action = "Post" }, new { httpMethod = new HttpMethodConstraint("POST") });
            RouteTable.Routes.MapHttpRoute("custom-api-ApiPut", "custom-api/{controller}", new { action = "Put" }, new { httpMethod = new HttpMethodConstraint("PUT") });
            RouteTable.Routes.MapHttpRoute("custom-api-ApiDelete", "custom-api/{controller}", new { action = "Delete" }, new { httpMethod = new HttpMethodConstraint("DELETE") });
    

    Commenting out those lines fixes the problem - but then we cannot use our custom WebApi on the website.

    Does any of you have any ideas what is going on and how to fix the problem?

    Thanks!

  • Comment author was deleted

    Oct 02, 2015 @ 12:22

    Your custom routes needs to live in /umbraco/backoffice/... then the auth error will go away

  • Comment author was deleted

    Oct 02, 2015 @ 12:24

    So update to

    RouteTable.Routes.MapHttpRoute("custom-api-ApiWithAction", "umbraco/backoffice/custom-api/{controller}/{action}/{id}", new { id = RouteParameter.Optional });
    
  • Emil Christiansen 66 posts 148 karma points
    Oct 02, 2015 @ 12:37
    Emil Christiansen
    0

    That fixed the problem... thanks!

    If i may ask - what are the explanation behind the "umbraco/backoffice" prefix?

    It seems a bit strange... does it make any sense when we are talking about some custom routes which have nothing to do with the backoffice :) ?

  • Comment author was deleted

    Oct 02, 2015 @ 12:39

    If I remember correct it's because of member and user authentication not being mixed up

  • Emil Christiansen 66 posts 148 karma points
    Oct 02, 2015 @ 12:42
    Emil Christiansen
    0

    Ok, thanks Tim.

    The most important thing is that it is working now...

    It really doesn't matter how the routes are defined... but still think it is a bit strange :)

    Have a great weekend.

  • Comment author was deleted

    Oct 02, 2015 @ 12:49

    No prob glad it's solved :)

  • Carole Logan 17 posts 118 karma points MVP 7x c-trib
    Jan 13, 2016 @ 15:50
    Carole Logan
    0

    Hi,

    I am also having this issue. I have 2 custom routes that arebeing used when fetching examine data. When I comment out both of these, examine works. Is there a fix for this that doesn't involve changing the route URL to include '/umbraco/backoffice/'?

    Thanks, Carole

  • Ian 178 posts 752 karma points
    Jan 13, 2016 @ 16:52
    Ian
    0

    Hi, some of the documentation about routes in umbraco is a bit confusing. This is what I have found, confirmed by looking at routing in the Umbraco source code.

    The /umbraco/backoffice prefix must be used if you want to provide MVC routes which require back office users to be authenticated rather than front end members. This might be used if you want to use the Legacy iFrame section in umbraco, or load something up in a popup for any reason. These routes must be registered manually as Umbraco does not do any auto routing for this situation.

    For WebApi routes however your controller would normally inherit from one of the documented umbraco controller base classes. You would not register your own routes and would instead rely on Umbraco auto routing to do the job.

Please Sign in or register to post replies

Write your reply to:

Draft