How require authorization within whole ASP .NET MVC application

Question

I create application where every action beside those which enable login should be out of limits for not logged user.

Should I add [Authorize] annotation before every class' headline? Like here:

namespace WebApplication2.Controllers {
[Authorize]
    public class HomeController : Controller {




        public ActionResult Index() {
            return View();
        }

        public ActionResult About() {
            ViewBag.Message = "Your application description page.";

            return View();
        }

        public ActionResult Contact() {
            ViewBag.Message = "Your contact page.";

            return View();
        }
    }
}

or there is a shortcut for this? What if I want to change rules for one and only action in particular controller?

Possible duplicate of Can the [Authorize] attribute be set globally for all controllers? — KyleMit
– KyleMit ♦, Commented Jan 5, 2018 at 14:50

DavidG · Accepted Answer · 2015-08-21 13:29:45Z

45

Simplest way is to add Authorize attribute in the filter config to apply it to every controller.

public class FilterConfig
{
    public static void RegisterGlobalFilters(GlobalFilterCollection filters)
    {
        filters.Add(new HandleErrorAttribute());

        //Add this line
        filters.Add(new AuthorizeAttribute());
    }
}

Another way is to have all of your controllers inheriting from a base class. This is something I do often as there is almost always some shared code that all of my controllers can use:

[Authorize]
public abstract class BaseSecuredController : Controller
{
    //Various methods can go here
}

And now instead of inheriting from Controller, all of your controllers should inherit this new class:

public class MySecureController : BaseSecuredController
{
}

Note: Don't forget to add AllowAnonymous attribute when you need it to be accessible to non-logged in users.

edited Aug 21, 2015 at 13:29

answered Jul 26, 2014 at 12:29

DavidG

120k13 gold badges232 silver badges239 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Serj Sagan · Accepted Answer · 2015-11-16 17:39:39Z

11

To build upon DavidG's answer, if you need to require a certain role (in Windows authentication, for example, where everyone is authorized) you can do this:

public class FilterConfig
{
    public static void RegisterGlobalFilters(GlobalFilterCollection filters)
    {
        filters.Add(new HandleErrorAttribute());

        filters.Add(new AuthorizeAttribute { Roles = "MyApp Access" });
    }
}

answered Nov 16, 2015 at 17:39

Serj Sagan

30.6k17 gold badges159 silver badges190 bronze badges

Comments

David Liang · Accepted Answer · 2022-11-17 03:03:10Z

0

I know the OP was tagged with just asp.net-mvc-5, but for completeness, for ASP.NET Core MVC 6, if you're building controllers with views (via builder.Services.AddControllersWithViews()), there are 2 ways you can require authorization for the whole app:

Set authorization policy

namespace DL.Poc.Identity.Server
{
    public class Program
    {
        public static void Main(string[] args)
        {
            var builder = WebApplication.CreateBuilder(args);

            ...

            builder.Services.AddControllersWithViews();

            builder.Services.AddAuthorization(options =>
            {
                options.FallbackPolicy = new AuthorizationPolicyBuilder()
                    .RequireAuthenticatedUser()
                    .Build();
            });

            var app = builder.Build();

            ...

            app.UseAuthorization();

            app.MapControllerRoute(
                name: "areaRoute",
                pattern: "{area:exists}/{controller=home}/{action=index}/{id?}");

            app.MapControllerRoute(
                name: "default",
                pattern: "{controller=home}/{action=index}/{id?}");

            app.Run();
        }
    }
}

Add authorization filter

namespace DL.Poc.Identity.Server
{
    public class Program
    {
        public static void Main(string[] args)
        {
            var builder = WebApplication.CreateBuilder(args);

            ...

            builder.Services.AddControllersWithViews(options =>
            {
                var policy = new AuthorizationPolicyBuilder()
                 .RequireAuthenticatedUser()
                 .Build();

                options.Filters.Add(new AuthorizeFilter(policy));
            });

            var app = builder.Build();

            ...

            app.UseAuthorization();

            app.MapControllerRoute(
                name: "areaRoute",
                pattern: "{area:exists}/{controller=home}/{action=index}/{id?}");

            app.MapControllerRoute(
                name: "default",
                pattern: "{controller=home}/{action=index}/{id?}");

            app.Run();
        }
    }
}

answered Nov 17, 2022 at 3:03

David Liang

21.6k7 gold badges50 silver badges78 bronze badges

2 Comments

Yoda Over a year ago

Are you reffering to .NET 6 or something that was short lived few years ago and was caled ASP .NET MVC 6 before they switched to ASP .Net Core naming?

David Liang Over a year ago

I am referring .NET 6 and ASP.NET Core MVC: learn.microsoft.com/en-us/aspnet/core/mvc/…

Collectives™ on Stack Overflow

How require authorization within whole ASP .NET MVC application

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related