[#288] [add] impl

Author: i4004

src/Simplify.Web.Tests/RequestHandling/Handlers/SetLoginUrlForUnauthorizedRequestHandlerTests.cs

@@ -43,6 +43,24 @@ public async Task HandleAsync_StatusCodeIsUnauthorized_SetLoginReturnUrlFromCurr
 		_redirector.Verify(x => x.SetLoginReturnUrlFromCurrentUri());
 	}
 
+	[Test]
+	public async Task HandleAsync_UnauthorizedButResponseAlreadyStarted_SetLoginReturnUrlFromCurrentUriNotCalled()
+	{
+		// Arrange
+
+		var httpContext = Mock.Of<HttpContext>(x =>
+			x.Response.StatusCode == (int)HttpStatusCode.Unauthorized && x.Response.HasStarted == true);
+		var next = new Mock<RequestHandlerAsync>();
+
+		// Act
+		await _handler.HandleAsync(httpContext, next.Object);
+
+		// Assert
+
+		next.Verify(x => x.Invoke());
+		_redirector.Verify(x => x.SetLoginReturnUrlFromCurrentUri(), Times.Never);
+	}
+
 	[Test]
 	public async Task HandleAsync_StatusCodeIsNoUnauthorized_SetLoginReturnUrlFromCurrentUriNotCalled()
 	{

src/Simplify.Web/RequestHandling/Handlers/SetLoginUrlForUnauthorizedRequestHandler.cs

@@ -20,7 +20,10 @@ public async Task HandleAsync(HttpContext context, RequestHandlerAsync next)
 	{
 		await next();
 
-		if (context.Response.StatusCode == (int)HttpStatusCode.Unauthorized)
+		// The login return URL is stored in a Set-Cookie header, which cannot be added once the
+		// response has started (e.g. a controller that returned 401 together with a body). Skip it
+		// in that case instead of throwing "response has already started".
+		if (context.Response.StatusCode == (int)HttpStatusCode.Unauthorized && !context.Response.HasStarted)
 			redirector.SetLoginReturnUrlFromCurrentUri();
 	}
 }