Authorization in ASP.NET Core

Suggested Videos
Part 68 - ASP.NET core identity password complexity | Text | Slides
Part 69 - Show or hide login and logout links based on login status in asp.net core | Text | Slides
Part 70 - Implementing login functionality in asp.net core | Text | Slides

In this video we will discuss, authorization in ASP.NET Core. 


What is Authorization in ASP.NET Core

• Authentication is the process of identifying who the user is. 
• Authorization is the process of identifying what the user can and cannot do.
• For example, if the logged in user is an administrator he may be able to Create, Read, Update and Delete orders, where as a normal user may only view orders but not Create, Update or Delete orders.
• Authorization in ASP.NET Core MVC is controlled through the AuthorizeAttribute

Authorize Attribute in ASP.NET Core

When the Authorize attribute is used in it's simplest form, without any parameters, it only checks if the user is authenticated.

Authorize Attribute Example

As the Authorize attribute is applied on the Controller, it is applicable to all the action methods in the controller. The user must be logged in, to access any of the controller action methods.

[Authorize]
public class HomeController : Controller
{
    public ViewResult Details(int? id)
    { 
    }
        
    public ViewResult Create()
    {   
    }
        
    public ViewResult Edit(int id)
    {
    }
}

Authorize attribute can be applied on individual action methods as well. In the example below, only the Details action method is protected from anonymous access.

public class HomeController : Controller
{
    [Authorize]
    public ViewResult Details(int? id)
    {
    }

    public ViewResult Create()
    {
    }

    public ViewResult Edit(int id)
    {
    }
}

AllowAnonymous Attribute in ASP.NET Core

As the name implies, AllowAnonymous attribute allows anonymous access. We generally use this attribute in combination with the Authorize attribute.

AllowAnonymous Attribute Example

As the Authorize attribute is applied at the controller level, all the action methods in the controller are protected from anonymous access. However, since the Details action method is decorated with AllowAnonymous attribute, it will be allowed anonymous access.

[Authorize]
public class HomeController : Controller
{
    [AllowAnonymous]
    public ViewResult Details(int? id)
    {
    }

    public ViewResult Create()
    {
    }

    public ViewResult Edit(int id)
    {
    }
}

Please note: If you apply [AllowAnonymous] attribute at the controller level, any [Authorize] attribute attribute on the same controller actions is ignored.

Apply Authorize attribute globally

To apply [Authorize] attribute globally on all controllers and controller actions throughout your application modify the code in ConfigureServices method of the Startup class.

public void ConfigureServices(IServiceCollection services)

{

    // Other Code

    services.AddMvc(config => {

        var policy = new AuthorizationPolicyBuilder()

                        .RequireAuthenticatedUser()

                        .Build();

        config.Filters.Add(new AuthorizeFilter(policy));

    });

    // Other Code

}

• AuthorizationPolicyBuilder is in Microsoft.AspNetCore.Authorization namespace 
• AuthorizeFilter is in Microsoft.AspNetCore.Mvc.Authorization namespace

If you do not have [AllowAnonymous] attribute on the Login actions of the AccountController you will get the following error because the application is stuck in an infinite loop. 

HTTP Error 404.15 - Not Found

The request filtering module is configured to deny a request where the query string is too long.

Most likely causes:
Request filtering is configured on the Web server to deny the request because the query string is too long.

1. You try to access /Account/login
2. Since the [Authorize] attribute is applied globally, you cannot access the URL /Account/login
3. To login you have to go to /Account/login
4. So the application is stuck in this infinite loop and every time we are redirected, the query string ?ReturnUrl=/Account/Login is appended to the URL
5. This is the reason we get the error - Web server denied the request because the query string is too long.

To fix this error, decorate Login() actions in the AccountController with [AllowAnonymous] attribute.

In addition to this simple authorization, asp.net core supports role based, claims based and policy based authorization. We will discuss these authorization techniques in our upcoming videos.