Authorization help in asp net mvc 5

Question

I am having a hard time understanding on how to add some sort of authorization to my application. This is how my login controller looks like now:

private UserProvider mUserProvider;
    // GET: Login
    public ActionResult Index()
    {
        return View();
    }

    [HttpPost]
    [AllowAnonymous]
    [ValidateAntiForgeryToken]

    public ActionResult Login(LoginViewModel model)
    {
        string userName = AuthenticateUser(model.UserName, model.Password);
        if (!(String.IsNullOrEmpty(userName)))
        {
            Session["UserName"] = userName;
            return View("~/Views/Home/Default.cshtml");
        }
        else
        {
            ModelState.AddModelError("", "Bad login");
            return View("~/Views/Home/Login.cshtml");
        }
    }

    public string AuthenticateUser(string username, string password)
    {
            //do stuff and get the special username
            return sUsername;
    }

What would I need to add in order to make sure a non authenticated user can´t view any other page besides the login?

ps: I am 100% required to use AuthenticateUser.

Thank you for your time.

Have you tried decorating your other secure action methods with [Authorize]? — QFDev
– QFDev, Commented May 20, 2015 at 16:30

David L · Accepted Answer · 2015-05-20 16:36:50Z

1

If you place the Authorize attribute on all of your other controllers, users will not be able to access any methods within those controllers if they are not authenticated.

public class LoginController
{
}

[Authorize]
public class HomeController
{
}

In this case, all of your LoginController methods look like they should allow anonymous access and you should decorate them as such. Also, making AuthenticateUser private would probably be a good security measure.

edited May 20, 2015 at 16:36

answered May 20, 2015 at 16:31

David L

34.1k8 gold badges70 silver badges98 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

jiggergargle Over a year ago

I tried adding that and now the "main page" does not show anything is there anything i need to add for the Authorize tag to have an effect?

David L Over a year ago

@jiggergargle Check the http response. Is the status code a 401? If so, that would indicate it IS working and you aren't authenticated.

QFDev · Accepted Answer · 2015-05-20 16:43:35Z

Decorating the action methods you want to secure with [Authorize] would work. You can even add this at the controller level and selectively [AllowAnonymous] on specific actions.

It's useful if most of your action methods need to be secured, to register a GlobalFilter so that all actions are treated as [Authorize] by default. This way you're less likely to miss one and inadvertently allow anonymous access to a route that should be secure.

public static void RegisterGlobalFilters(GlobalFilterCollection filters)
{
    filters.Add(new AuthorizeAttribute());
}

If you're using FormsAuthentication, in your web.config you can set a default redirect for any calls that are made to secure action methods where no valid session exists.

<authentication mode="Forms">
    <forms name=".ASPXAUTH" loginUrl="/login" protection="All" path="/" timeout="60" />
</authentication>

Collectives™ on Stack Overflow

Authorization help in asp net mvc 5

2 Answers 2

2 Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Related