c# - Is ist ok to throw a HttpException(401) in custom AuthorizeAttribute? -

i have custom authorizeattribute:

public class myauthattribute:authorizeattribute {  protected override bool authorizecore(httpcontextbase httpcontext) {     return currentuser.roles.contains(this.roles);  } } 

now return currentuser.roles works fine. if returns false, browser displays 401.

but want add additional information roles asked for. instead of return throw exception myself:

throw new httpexception(401,string.format("user should have been in 1 of following roles: {0}",this.roles); 

is ok throw 401-exception inside authorizeattribute instead of returning false? or there other (better) ways information browser?

if going send 401 send normal 401 www-authenticate header (if aren't using form of authentication uses www-authenticate 401 inappropriate). if want give information in body of custom html response goes 401 (it shown if user cancels out of authentication prompt).

for other case something, choosing not allow particular user so, use 403.