asp.net authorization - deny all before login except the register page

Question

I'm using ASP.NET Authorization to deny users access to my site before logging in, but this is also blocking the Register.cshtml page. How do I sort out my authorizations to allow this page through?

<system.web>
<authorization>
      <deny users="?" />
    </authorization>
  </system.web>

  <location path="Content">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>

  <location path="Register.cshtml">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>

possible duplicate of Allow Anonymous to call certain action in asp.net mvc 3 — Amit
– Amit, Commented Jul 10, 2013 at 12:06

Satpal · Accepted Answer · 2014-08-16 06:12:29Z

IMHO, you should not use web.config to control the authentication of your application instead use Authorize attribute.

Add this in your Global.asax file under RegisterGlobalFilters method

    public static void RegisterGlobalFilters(GlobalFilterCollection filters)
    {
        filters.Add(new HandleErrorAttribute());
        filters.Add(new AuthorizeAttribute());
    }

or you can decorate also your controller with [Authorize]

[Authorize]
public class HomeController : Controller
{
    ...
}

For action which require Anonymous access use AllowAnonymous attribute

   [AllowAnonymous]
   public ActionResult Register() {
      // This action can be accessed by unauthorized users
      return View("Register");   
   }

As per Reference,

You cannot use routing or web.config files to secure your MVC application. The only supported way to secure your MVC application is to apply the Authorize attribute to each controller and use the new AllowAnonymous attribute on the login and register actions. Making security decisions based on the current area is a Very Bad Thing and will open your application to vulnerabilities.

Using these attributes, am I able to specify which roles are allowed to access certain pages?
@Neeta, yes you can there are ample material available to guide you like geekswithblogs.net/tyarmer/archive/2010/02/25/…

Nipun Ambastha · Accepted Answer · 2013-07-10 10:24:01Z

0

This is happening because you are denying everyone from application by using

<authorization>
      <deny users="?" />
    </authorization>

Above code will override all permission given to the folder

Good idea would be Deny user folderwise and keep Register/Login/Help/Contact pages at root level.

answered Jul 10, 2013 at 10:24

Nipun Ambastha

2,5931 gold badge17 silver badges26 bronze badges

2 Comments

litterbugkid Over a year ago

Good advice except I don't think it's a good idea to mess up the folder structure just for authorization.

Nipun Ambastha Over a year ago

Agreed on this it will be a pain

Collectives™ on Stack Overflow

asp.net authorization - deny all before login except the register page

2 Answers 2

2 Comments

2 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

2 Comments

Linked

Related