Global Authorization Filter in ASP.NET Core

-

This blog is going to explain how to authorize the ASP.NET Core application globally. That is, it is not necessary to add the [Authorize] attribute to each controller or action method. The global authorization filter helps you to authorize the entire application. You can achieve this in a few steps.

Step 1:
Add the following code to the Startup.cs file in ConfigureServices mode. In the code first, the authorization policy has been created using AuthorizationPolicyBuilder(). It has several methods to create authorization policies. Here I have added the RequireAuthenticatedUser() method. It checks whether the user is authenticated or not. Similar to the [Authorize] filter. By adding this method you do not have to add the [Authorize] filter attribute to all controllers and methods. Finally, the global authorization filter is added using config.Filters.Add(new AuthorizeFilter(policy));

Startup.cs 
public void ConfigureServices(IServiceCollection services)
{
  ...
  ...
  ...

    var policy = new AuthorizationPolicyBuilder()
                .RequireAuthenticatedUser()
                .Build();

    services.AddMvc(config =>
    {
        config.Filters.Add(new AuthorizeFilter(policy));
    });

    services.AddControllersWithViews();
}

Step 2:
You must add the [AllowAnonymous] attribute to the controller or action method that does not require authentication. For example, login page, register page, etc. If you want that the entire controller does not require authentication, add the [AllowAnonymous] attribute to the controller level. The following code snippets explaining how to add the controller level [AllowAnonymous] attribute.

(I did not include action method coding for simplicity of code. You can check the simple cookie authentication blog if you wish).

[AllowAnonymous]
public class AccountController : Controller
{
    [HttpGet]
    public ActionResult Login()
    {
     // Login code
    }

    [HttpPost]
    public async Task<ActionResult> Login(Users user)
    {
     // Login code
    }

    [HttpPost]
    public async Task<ActionResult> Logout()
    {
      // logout code
    }
}

If you want to make anonymous a particular action method, that means you do not have to log in to access that page. You can add the [AllowAnonymous] attribute to that action method. By doing so, all action methods in the controller verify the authentication, but the [AllowAnonymous] added method does not verify the authentication.

Method level 
public class AccountController : Controller
{
    [AllowAnonymous]
    [HttpGet]
    public ActionResult Login()
    {
     // Login code
    }
}

Note:
If you do not add the [AllowAnonymous] attribute to the login page it will throw the following error.
HTTP Error 404.15 - Not Found The request filtering module is configured to deny a request where the query string is too long.

I hope this helps you. Keep coding.


Similar Article
Simple Cookie Authentication in ASP.NET Core

Comments

Post a Comment

Popular posts from this blog

Entity Framework Core (EF) with SQL Server LocalDB

-
Image
This blog is going to illustrate how to implement Entity Framework (EF) Core with SQL Server LocalDB. The Entity Framework Core enables access to data from the database. This allows developers to avoid having to write most of the data access code. And the SQL Server LocalDB works similarly to the SQL SERVER with few features. You can get the LocalDB when you install visual studio or visual studio express. You can find the .mdf and _log.ldf files in the C:/Users/{user} directory. Let see how to create a SQL Server LocalDB and implement Entity Framework Core Step 1: The first step is to add a connection. In the menu -> click Tools and select Connect to Database It will display the Add Connection window. Enter (localdb)\mssqllocaldb in the server name textbox. Then in the Select or enter a database, select master and click ok Now in the server explorer, you can find the master DB containing Tables, Views, Stored
Read more

SignalR with JavaScript in ASP.NET Core MVC

-
Image
This blog is going to explain what is SignalR and how to implement it in ASP.NET Core. SignalR is a real time application framework for ASP.NET Core. Using SignalR you can provide updated information without refreshing the page, for example poll results, game score, chat etc. Let's see how to achieve it in ASP.NET Core MVC. Step 1: First step I added the SignalR client library. To add a SignalR client library, Right click on the project in Solution Explorer and Add -> Client-Side Library. Select the provider as unpkg as shown in the image below. Enter the latest version of SignalR into the library. And selected signalr.js and signalr.min.js files. Finally clicked the install button to install the client library. Step 2: At this step I have created a VoteHub.cs class inside the Hubs folder(create a new folder called Hubs). This class inherits from the Hub class which is a base class of SignalR hub. The SendMessage method will be called by the connected client.
Read more

Localization in ASP.NET Core MVC with Example

-
Image
Using Query Strings for Request Culture and Simplifying Localization with IStringLocalizer Interface Let’s see how to implement Localization in ASP.NET Core MVC. In the first example, I am going to use the IStringLocalizer Interface in the controller to implement Localization. Additionally, when the user passes the desired language through the query string, it will display content in that language. First, let’s configure the settings in the program.cs file. builder.Services.AddLocalization(options => options.ResourcesPath = "Resources");  The AddLocalization method adds the localization service to the service container. I have added the supported cultures here. I have added two cultures: en for English and nl for Dutch. In the RequestCultureProviders , I have included QueryStringRequestCultureProvider() . This allows the system to determine the culture information from the query string. UseRequestLocalization initializes a RequestLocalizationOptions objec
Read more