What happens when [Authorize] fails? ...

There seems to be no mention as to what default actions are taken by the middleware when an [Authorize] check fails, for example:

- Does the middleware respond with a specific status code (401)?
- Does the middleware respond with a redirect? (302) -- and if so, what URL does the redirect use?

The current "documentation" only states the following:

> applying the [Authorize] attribute ... limits access to that component to any authenticated user.

I may have missed it, but I cannot seem to find any details with regard to what happens when authorization checks fail. Also, if they do fail, is there a mechanism to control what happens next (with respect to the middleware pipeline)?

To date, experimentation shows that the default action is a 302 redirect -- but how the redirect URL can be changed programmatically remains a mystery! (at least to me).

Thank-you for your consideration.

---
#### Document Details

⚠ *Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.*

* ID: 4c3930e5-8a4f-8bdf-7167-9aed8afc4253
* Version Independent ID: cea5942d-fb01-f5bf-3b63-25873d5b79cf
* Content: [Simple authorization in ASP.NET Core](https://docs.microsoft.com/en-us/aspnet/core/security/authorization/simple?view=aspnetcore-5.0)
* Content Source: [aspnetcore/security/authorization/simple.md](https://github.com/dotnet/AspNetCore.Docs/blob/master/aspnetcore/security/authorization/simple.md)
* Product: **aspnet-core**
* Technology: **aspnetcore-security**
* GitHub Login: @Rick-Anderson
* Microsoft Alias: **riande**