ASP.NET core how to use Authentication only for specific routes?

Question

I configured to use windows authentication for my asp.net react app.

on ConfigureServices() method:

services.AddAuthentication(NegotiateDefaults.AuthenticationScheme).AddNegotiate();
services.AddAuthorization(options =>
{
    options.FallbackPolicy = options.DefaultPolicy;
});

then on configure() method:

app.UseAuthentication();
app.UseAuthorization();
app.UseEndpoints(endpoints =>
{
    endpoints.MapControllers();
});

However, by doing so, all requests will trigger the authentication process. I actually only want my api routes (in /api/my/resource ) to be secure using windows authentication, and want to let the whole react resource folder to be public (in /any/path/here).

How do I configure to use windows authentication only for route starting with /api.

Hi. Have you tried Authorize & AllowAnonymous attributes learn.microsoft.com/en-us/aspnet/core/security/authorization/… — Vidiya Prasanth Pappannan
– Vidiya Prasanth Pappannan, Commented Jul 25, 2022 at 22:36
You can implement Role-Based Authorization Or Policy-Based Authorization with Windows Authentication, then in the API controller, use the Authorize attribute to apply the policy to the controller. Refer to the following links: ASP.NET Core - Authorization Using Windows Authentication and Create Role-Based Authorization with Windows Authentication. — Zhi Lv
– Zhi Lv, Commented Jul 26, 2022 at 3:41
Thanks, guys. I came up with a way to do it, it is very simple actually. Please see my answer. @ZhiLv — KaraNoKara
– KaraNoKara, Commented Jul 26, 2022 at 18:53

Connor Low · Accepted Answer · 2022-07-28 15:43:31Z

6

I achieved that by just doing this:

services.AddAuthorization(options =>
{
    // don't use default policy
    // options.FallbackPolicy = options.DefaultPolicy;
});

Then add [Authorize] to the controllers that need authentication.

[Authorize]     // trigger authentication process
[Route("api/[controller]")]
[ApiController]
public class MyController : ControllerBase {}

Then I can choose specific routes to require authentication.

edited Jul 28, 2022 at 15:43

Connor Low

7,4343 gold badges39 silver badges64 bronze badges

answered Jul 26, 2022 at 18:58

KaraNoKara

1632 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

ASP.NET core how to use Authentication only for specific routes?

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related