Skip to content

Commit 64f6ca5

Browse files
committed
VPR-54 fix(scheduler): render Razor 403 view for dashboard auth denials
Hangfire's dashboard middleware writes a bare 403 directly to the response when our IDashboardAuthorizationFilter returns false, which bypasses cookie auth's AccessDeniedPath and lands the user on the browser's default error page. Add UseStatusCodePagesWithReExecute so any bare 4xx/5xx status code re-runs through HomeController.Error and the existing /Views/Home/403.cshtml view. Applies globally — also catches stray bare 404s from any other middleware. Status code is preserved on the response (browser still sees 403); only the body is replaced with the rendered view.
1 parent 3a1c550 commit 64f6ca5

2 files changed

Lines changed: 8 additions & 3 deletions

File tree

web/Classes/Scheduler/HangfireExtensions.cs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -107,9 +107,9 @@ public static WebApplication UseViperHangfire(this WebApplication app)
107107
return app;
108108
}
109109

110-
// The dashboard's "Back to site" link uses AppPath verbatim;
111-
// we have no UsePathBase middleware so the /2/ deployment prefix
112-
// (TEST/PROD) must come from config.
110+
// Hangfire renders the configured AppPath as-is in the dashboard
111+
// "Back to site" link. With no UsePathBase middleware, we need to
112+
// supply the /2 deployment prefix from configuration ourselves.
113113
var dashboardAppPath = app.Configuration.GetValue<string>(DashboardAppPathKey) ?? "/Computing";
114114
app.MapHangfireDashboard(DashboardPath, new DashboardOptions
115115
{

web/Program.cs

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -399,6 +399,11 @@ void RegisterDbContext<TContext>(string connectionStringKey) where TContext : Db
399399

400400
}
401401

402+
// Re-execute bare status-code responses (403, 404, etc.) through HomeController.Error
403+
// so middleware that writes raw status codes — e.g. Hangfire's dashboard middleware
404+
// when our auth filter denies — gets the same Razor error view as the rest of the app.
405+
app.UseStatusCodePagesWithReExecute("/Error/{0}");
406+
402407
// In development, set up Vite proxy BEFORE rewrite rules so it can handle .ts/.js files
403408
if (app.Environment.IsDevelopment())
404409
{

0 commit comments

Comments
 (0)