Why does a caught System.UnauthorizedAccessException exception redirect me to an error page?

Question

When this code executes in a custom web part:

try{
   ...Offending code here...
}
catch (System.UnauthorizedAccessException e)
{
     //Do nothing if the user doesn't have access to the site or list.
}

I am redirected to the _layouts/AccessDenied.aspx error page that displays: "Error: Access Denied". Shouldn't the handled exception be ignored? Am I missing something?

Answer 1

If the user doesn't have access to the page your web part is running on then it will never reach that code.

You might be able to override PreInit or one of the other page lifecycle events, but even then I don't see how your specific code is going to override the fact that they don't have access.

Here's a page lifecycle reference:

http://msdn.microsoft.com/en-us/library/ms178472.aspx

You can also try something like this, but again you have to be able to set it as early on in the page lifecycle for it to have any chance of working:

http://sridharu.blogspot.com/2008/07/how-to-avoid-access-denied-page.html

Answer 2

This is because SharePoint's error handling treats the UnauthorizedAccessException as a special exception and will ALWAYS redirect to the access denied page, there's even a special method to handle it:

Microsoft.SharePoint.SPGlobal.HandleUnauthorizedAccessException

You can turn this of by settings the following property:

SPSite.CatchAccessDeniedException = false;

P.S. it is not necessary to use an external database to get a list of all SPSite's a user has access to, this can be done using Search:Sites i have access to by Wonderlaura.

She mentions it is enterprise only, but since you are doing this in code, it'll work for any version but Foundation / WSS3 by using the FullTextSqlQuery class and then query for contentclass:STS_Site contentclass:STS_Web contentClass:sts_listitem_850