AuthorizeAttribute for Web API (ASP.NET Core 2)

Question

I want to use AuthorizeAttribute for my Web API methods. But when user is not authorized method returns Login-View instead simple 401-status-code.

Startup.cs:

public void ConfigureServices(IServiceCollection services)
{           
    // Another code.
    services.AddDefaultIdentity<User>(opt => {})
    .AddEntityFrameworkStores<MyDbContext>();
    // Another code.
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    // Another code.
    app.UseAuthentication();

    app.UseMvc(routes =>
    {
        routes.MapRoute(
            name: "default",
            template: "api/{controller}/{action=Index}/{id?}");
    });

    app.UseSpa(spa =>
    {
        spa.Options.SourcePath = "ClientApp";

        if (env.IsDevelopment())
        {
            spa.UseReactDevelopmentServer(npmScript: "start");
        }
    });
    // Another code.
}

SimpleController.cs:

[Route("api/[controller]")]
public class SimpleController : Controller
{
    [Authorize]
    [HttpGet("{id}")]
    public int Index(int Id)
    {
        return Id;
    }
}

In ASP.NET MVC 5 we have both AuthorizeAttribute:

System.Web.Http.AuthorizeAttribute - which is used for the web API.
System.Web.Mvc.AuthorizeAttribute - which is used for controllers with views.

But ASP.NET Core 2.0 has only one kind of attribute - for controllers with views. What do I need to do to get status-codes (401, 403) instead views?

Are you using forms authentication? Forms authentication will turn a 401 into a redirect to the login page. — user47589
– user47589, Commented Mar 15, 2019 at 20:57
That's your issue then. Don't use forms authentication with web api. Switch to cookie auth. See stackoverflow.com/questions/34880817/… — user47589
– user47589, Commented Mar 15, 2019 at 21:03
Is your whole project is api? Do you need to return 401/403 all over the project, right? — Oleksandr
– Oleksandr, Commented Mar 15, 2019 at 21:22
@Alexander Yes, I use ASP.NET + SPA (React) and therefore I need to return 401/403 all over the project. — Palindromer
– Palindromer, Commented Mar 15, 2019 at 21:25

Oleksandr · Accepted Answer · 2019-03-15 22:08:20Z

4

ASP.NET Core Identity uses cookie authentication and therefore you can override CookieAuthenticationOptions.Events to make it work as you need. Identity provides ConfigureApplicationCookie configuration method for this.

services.ConfigureApplicationCookie(options =>
{
    //this event is called when user is unauthorized and is redirected to login page
    options.Events.OnRedirectToLogin = context =>
    {
        context.Response.StatusCode = 401;

        return Task.CompletedTask;
    };
});

answered Mar 15, 2019 at 22:08

Oleksandr

9,7601 gold badge22 silver badges45 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

AuthorizeAttribute for Web API (ASP.NET Core 2)

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related