Quote from Jonathon Wyza on February 19, 2018, 8:06 pm

@Miracleman - I actually faced a similar problem with this today.  The issue stems from how MVC routes Unauthorized requests which is to redirect you to "/Account/AccessDenied?returnUrl=where-i-came-from".  In this case if you go into AccountController and find the AccessDenied method.  Replace it with this:

 [AllowAnonymous]
 [HttpGet("/account/accessDenied")]
 public IActionResult AccessDenied(string returnUrl)
 {
 return StatusCode((int) HttpStatusCode.Forbidden);
 }

The problem is that [HttpGet] was setting it to "/api/Account/AccessDenied" and it needed to be "/Account/AccessDenied".  The other thing is it returns "Unauthorized" but really we want "Forbid" so that it doesn't log you out when you fail.  I think I still need to refine this a bit to clean it up, but now instead of just breaking outright, I get an actual error in the UI as expected.

 

In your case my guess is that your user doesn't have the right roles for the items in your app and thus getting rejected on everything.  But it's hard to find that when it breaks :).

Quote from Eben Monney on February 22, 2018, 7:02 am

To add to what Jonathan said also cross check the router configuration at the client side. This is typically a symptom of an incorrectly configured client route.

Also ensure the URL that is being pointed to is valid and well formed. Navigation at the client side should be intercepted by the angular router without reloading the page.