In this video we will discuss, authorization in ASP.NET Core.
Text version of the video
https://csharp-video-tutorials.blogspot.com/2019/06/authorization-in-aspnet-core.html
Healthy diet is very important for both body and mind. We want to inspire you to cook and eat healthy. If you like Aarvi Kitchen recipes, please support by sharing, subscribing and liking.
https://www.youtube.com/channel/UC7sEwIXM_YfAMyonQCrGfWA/?sub_confirmation=1
Slides
https://csharp-video-tutorials.blogspot.com/2019/06/authorization-in-aspnet-core-slides.html
ASP.NET Core Text Articles & Slides
https://csharp-video-tutorials.blogspot.com/2019/01/aspnet-core-tutorial-for-beginners.html
ASP.NET Core Tutorial
https://www.youtube.com/playlist?list=PL6n9fhu94yhVkdrusLaQsfERmL_Jh4XmU
Angular, JavaScript, jQuery, Dot Net & SQL Playlists
https://www.youtube.com/user/kudvenkat/playlists?view=1&sort=dd
What is Authorization in ASP.NET Core
Authentication is the process of identifying who the user is.
Authorization is the process of identifying what the user can and cannot do.
For example, if the logged in user is an administrator he may be able to Create, Read, Update and Delete orders, where as a normal user may only view orders but not Create, Update or Delete orders.
Authorization in ASP.NET Core MVC is controlled through the AuthorizeAttribute
Authorize Attribute in ASP.NET Core
When the Authorize Attribute is used in it's simplest form, without any parameters, it only checks if the user is authenticated.
Authorize Attribute Example
As the Authorize attribute is applied on the Controller, it is applicable to all the action methods in the controller. The user must be logged in, to access any of the controller action methods.
[Authorize]
public class HomeController : Controller
{
public ViewResult Details(int? id)
{
}
public ViewResult Create()
{
}
public ViewResult Edit(int id)
{
}
}
Authorize attribute can be applied on individual action methods as well. In the example below, only the Details action method is protected from anonymous access.
public class HomeController : Controller
{
[Authorize]
public ViewResult Details(int? id)
{
}
public ViewResult Create()
{
}
public ViewResult Edit(int id)
{
}
}
AllowAnonymous Attribute in ASP.NET Core
As the name implies, AllowAnonymous attribute allows anonymous access. We generally use this attribute in combination with the Authorize attribute.
AllowAnonymous Attribute Example
As the Authorize attribute is applied at the controller level, all the action methods in the controller are protected from anonymous access. However, since the Details action methos is decorated with AllowAnonymous attribute, it will be allowed anonymous access.
[Authorize]
public class HomeController : Controller
{
[AllowAnonymous]
public ViewResult Details(int? id)
{
}
public ViewResult Create()
{
}
public ViewResult Edit(int id)
{
}
}
Please note: If you apply [AllowAnonymous] attribute at the controller level, any [Authorize] attribute attributes on the same controller (or on any action within it) is ignored.
Apply Authorize attribute globally
To apply [Authorize] attribute globally on all controlls and controller actions throught your application modify the code in ConfigureServices method of the Startup class.
public void ConfigureServices(IServiceCollection services)
{
// Other Code
services.AddMvc(config =] {
var policy = new AuthorizationPolicyBuilder()
.RequireAuthenticatedUser()
.Build();
config.Filters.Add(new AuthorizeFilter(policy));
});
// Other Code
}
AuthorizationPolicyBuilder is in Microsoft.AspNetCore.Authorization namespace
AuthorizeFilter is in Microsoft.AspNetCore.Mvc.Authorization namespace
If you do not have [AllowAnonymous] attribute on the Login actions of the account controller you will get the following error because the application is stuck in an infinite loop.
HTTP Error 404.15 - Not Found
The request filtering module is configured to deny a request where the query string is too long.
Most likely causes:
Request filtering is configured on the Web server to deny the request because the query string is too long.
You try to access /Account/login
Since the [Authorize] attribute is applied globally, you cannot access the URL /Account/login
To login you have to go to /Account/login
So the application is stuck in this infinite loop and every time we are redirected, the query string ?ReturnUrl=/Account/Login is appended to the URL
This is the reason we get the error - Web server denied the request because the query string is too long.
To fix this error, decorate Login() actions in the AccountController with [AllowAnonymous] attribute.