We Keep Coding

Authorization in ASP .NET Core Razor pages

I am unable to implement policy-based authorization in ASP .NET Core for an action on a razor page.
I read through this comprehensive document on authorization and used its examples as guidence.
Razor page action code:
[Authorize(Policy = "test")]
public async Task<IActionResult> OnGetCreateAsync(string id)
Code in service configuration:
_ = services.AddAuthorization(options => {
options.AddPolicy("test", policy =>
policy.RequireAssertion(context =>
false));
});
I expect that if I call the action or endpoint service, e.g.
GET /Account?handler=Create
then the request will be denied with a 403 status response because the "test" policy states that everyone is unauthorized. However, in actual practice, the action is successfully called.

Razor Pages doesn't support [Authorize] at the handler level. i.e. You can only authorise a page as a whole, on the PageModel itself, as noted in the docs:
Policies can not be applied at the Razor Page handler level, they must be applied to the Page.
If authorising the page as a whole isn't a workable solution, you might need to move your OnGetCreateAsync handler into a controller/action pair, which can be attributed with [Authorize] accordingly.
There's also a related GitHub issue in the docs for this:
The [Authorize] filter attribute has been supported since 2.0 in Razor Pages, but note that it works at the page model class level
If you need a better workaround, see akbar's answer and Jim Yabro's answer.

Another solution for it is to check authentication by if clause.like this:
if (!HttpContext.User.Identity.IsAuthenticated)
{
return Redirect("/Front/Index");
}
and you can check roles in it too by finding role:
var user = await _userManager.FindByEmailAsync(model.Email);
var roles = await _userManager.GetRolesAsync(user);

I would recommend following Razor Pages authorization conventions in ASP.NET Core that looks like this:
services.AddRazorPages(options =>
{
options.Conventions.AuthorizePage("/Contact");
options.Conventions.AuthorizeFolder("/Private");
options.Conventions.AllowAnonymousToPage("/Private/PublicPage");
options.Conventions.AllowAnonymousToFolder("/Private/PublicPages");
});
In your case with policy test it would look like this:
options.Conventions.AuthorizePage("/Account", "test");
Source:
https://learn.microsoft.com/en-us/aspnet/core/security/authorization/razor-pages-authorization?view=aspnetcore-5.0
Authorize attribute is supported but only on PageModel like this:
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.RazorPages;
namespace PageFilter.Pages
{
[Authorize]
public class ModelWithAuthFilterModel : PageModel
{
public IActionResult OnGet() => Page();
}
}
Source:
https://learn.microsoft.com/en-us/aspnet/core/razor-pages/filter?view=aspnetcore-5.0#authorize-filter-attribute

Don't use the AuthorizeAttribute since it's unsupported.
Instead, once you have configured your policies in Startup.cs, you will be able to check those policies from within the page handlers.
Inject IAuthorizationService into your page model constructor
Call AuthorizeAsync() from within the handler.
Run a conditional check on the result's .Succeeded property.
If .Succeeded is false, return a Forbid() result.
This has nearly the same result as the [Authorize(Policy=...)] but executes later in the page lifecycle.
using Microsoft.AspNetCore.Authorization;
// ...
public class TestPageModel : PageModel {
readonly IAuthorizationService AuthorizationService;
public TestPageModel(IAuthorizationService authorizationService) {
AuthorizationService= authorizationService;
}
// Everyone can see this handler.
public void OnGet() { }
// Everyone can access this handler, but will be rejected after the check.
public async Task<IActionResult> OnPostAsync() {
// This is your policy you've defined in Startup.cs
var policyCheck = await AuthorizationService.AuthorizeAsync(User, "test");
// Check the result, and return a forbid result to the user if failed.
if (!policyCheck.Succeeded) {
return Forbid();
}
// ...
return Page(); // Or RedirectToPage etc
}
}

my workaround using Permission-based Authorization in ASP.NET Core :
[Authorize(Permissions.PageX.AddParameter)]
public async Task<IActionResult> OnPostAddParameterAsync(uint id, string key, string value)
{
if (!this.ArePermissionsValid()) return Forbid();
/// ...
}
public static class PageExtensions
{
public static bool ArePermissionsValid(this PageModel page)
{
try
{
var authorizeAttribute = new StackTrace().GetFrames().FirstOrDefault(x => x.GetMethod().Name.StartsWith("On")).GetMethod().GetCustomAttribute<AuthorizeAttribute>();
if (authorizeAttribute == null) return true;
var hasPermissions = page.User.Claims.Any(x => x.Type.Equals("permission") && x.Value.Equals(authorizeAttribute.Policy));
return hasPermissions;
}
catch (Exception e)
{
Log.Error($"${nameof(PageExtensions)}.{nameof(ArePermissionsValid)} | {e.Message}");
return false;
}
}
}

How to Authorize and sign in at the same time

To use my app, a user must go through the sign in process to be granted access to the various parts of the app. So regardless of the entrance to the app (whether they start at /home, or /somethingElse), I'd like the user to be authorized and given their permissions.
Their permissions come from the SignUpSignIn() function in the Account controller.
When a user tries to access /somethingElse, I have an [Authorize] attribute that sends them to the Azure B2C sign in. But after being "Authorized" the SignUpSignIn() function is never hit and their permissions aren't assigned to their session. So whatever location they end up at, doesn't work properly (
and likely errors).
How can I get a user to run through the SignUpSignIn() after being authorized?
This is how I'm Authorizing
namespace TaskWebApp.Controllers
{
[Authorize] //<---
public class SomethingElseController : Controller
{
// GET: SomethingElse
public ActionResult Index()
{
return View();
}
}
}
This is how a user gets their permissions.
public class AccountController : Controller
{
public async Task SignUpSignIn()
{
if (!Request.IsAuthenticated)
{ ///}
if (Request.IsAuthenticated)
{ //apply permissions to user's session }
}
}
I expect a user to go to /somethingelse, and be redirected to the Azure B2C SignIn page. Once they click "sign in" to run SignUpSignIn() from the Account controller and have their permissions assigned to their session.

After some research I found that this isn't a good method of reapplying the permissions via session.
Instead I have created something that looks like this:
namespace TaskWebApp.Controllers
{
[Authorize]
public class SomethingElseController : Controller
{
public async Task<ActionResult> Index(){
if(Session["foo"] == null){ //there is no session data
await SignUpSignIn("/somethingelse") //This goes to the account controller and applies permissions on the session
}
else
{
return View();
}
}
private async Task SignUpSignIn(string redirectLink = "")
{
var controller = DependencyResolver.Current.GetService<AccountController>();
controller.ControllerContext = new ControllerContext(Request.RequestContext, controller);
await controller.SignUpSignIn(redirectLink);
}
}
}

Custom Authorization filter in ASP.NET MVC 5?

In ASP.NET MVC 5 we can use [Authorize] attribute to check authorization and limit access to some actions\pages. I wonder how can I modify this attribute - authorization should be checked after some period of time?
For instance, let unauthorized user to see the page during 10 minutes and then block access.
Updated : it is seems that my question wasn't clear so I bolded the problem. I need to count time each unauthorized user spent on the site and then block him after N minutes.

You may implement a custom authorization for allowing anonymous browsing during a limited amount of time like this:
public class AuthorizeWithAnonymousTimeoutAttribute : AuthorizeAttribute
{
public int? AnonymousMinutesTimeout { get; set; }
public override void OnAuthorization(AuthorizationContext filterContext)
{
// Let default handling occurs
base.OnAuthorization(filterContext);
// If result is set, authorization has already been denied,
// nothing more to do.
if (filterContext.Result as HttpUnauthorizedResult != null)
return;
var isAnonAllowed = filterContext.ActionDescriptor.IsDefined(
typeof(AllowAnonymousAttribute), true) ||
filterContext.ActionDescriptor.ControllerDescriptor.IsDefined(
typeof(AllowAnonymousAttribute), true);
if (isAnonAllowed && AnonymousMinutesTimeout.HasValue &&
// Not authorized
!AuthorizeCore(filterContext.HttpContext))
{
const string visitStartCookieName = "visitStartCookie";
const string visitStartDateFormat = "yyyyMMddhhmmss";
var visitStartCookie = filterContext.HttpContext.Request
.Cookies[visitStartCookieName];
var now = DateTime.UtcNow;
DateTime visitStartDate;
var visitStartCookieValid = visitStartCookie != null &&
DateTime.TryParseExact(visitStartCookie.Value,
visitStartDateFormat, null, DateTimeStyles.AssumeUniversal,
out visitStartDate);
if (!visitStartCookieValid)
{
visitStartDate = now;
filterContext.HttpContext.Response.Cookies.Add(
// Session cookie. (Need to set an expiry date if
// a "permanent" cookie is wished instead.)
new HttpCookie
{
Name = "visitStartCookie",
Value = now.ToString(visitStartDateFormat)
});
}
if (visitStartDate.AddMinutes(AnonymousMinutesTimeout.Value) < now)
{
// Anonymous visit timed out
HandleUnauthorizedRequest(filterContext);
return;
}
}
}
}
Then, use it as a global filter if it suits you, like this:
public static void RegisterGlobalFilters(GlobalFilterCollection filters)
{
filters.Add(
new AuthorizeWithAnonymousTimeoutAttribute
{
// By example, 10 minutes
AnonymousMinutesTimeout = 10
});
// Your other filters
...
}
And do not forget to decorate your controllers or actions with AllowAnonymousAttribute:
[AllowAnonymous]
public class YourController
{
}
Or
public class YourController
{
[AllowAnonymous]
public ActionResult YourAction()
{
}
}
You may also put your custom authorize attribute directly on controllers or actions if defining it globally does not suit you:
// By example, 10 minutes anonymous browsing allowed.
[AuthorizeWithAnonymousTimeout(AnonymousMinutesTimeout = 10)]
public class YourController
{
}
Please note this implementation does not secure the anonymous timeout. A hacker may overcome it and browse anonymously as long as he wishes. Browser tools allow for cookie deletion, so it is easy to start with a fresh timeout.
My example also just set a session cookie, which will be gone by closing/re-opening the browser. Of course using another browser or device will allow for another 10 minutes of usage.
Securing an anonymous timeout is quite hard, since your user is anonymous. You may try to identify your anonymous users from their technical characteristics and then track their timeouts server side.
But you will probably run into many issues: corporate users browsing with the same IP address, or switching between different IP because they do not have a single Internet connection, ...

Something like this? Create your own attribute and override the default with your own code.
public class CustomAuthAttribute : AuthorizeAttribute
{
public override void OnAuthorization(AuthorizationContext filterContext)
{
base.OnAuthorization(filterContext);
//your code here
}
}
Then decorate your controllers/actions with [CustomAuthAttribute]

Below I have listed some examples that where and why to use AuthorizeAttribute
1.Check authorization and limit access to actions.
Example :
// Restrict unauthorized access:
[Authorize]
public ActionResult YourActionView()
{
return View();
}
// Restrict by user:
[Authorize(Users = "prashant,lua")]
public ActionResult YourActionView()
{
return View();
}
// Restrict by role:
[Authorize(Roles="Administrators")]
public ActionResult YourActionView()
{
return View();
}
2.Check authorization and limit access to controller.
// Restrict unauthorized access:
[Authorize]
public class ValuesController : ApiController
{
}
// Restrict by user:
[Authorize(Users="Prashant,Lua")]
public class ValuesController : ApiController
{
}
// Restrict by role:
[Authorize(Roles="Administrators")]
public class ValuesController : ApiController
{
}

Authorization with Session variables in asp net mvc 5

So my project requirements changed and now I think I need to build my own action filter.
So, this is my current login controller:
public class LoginController : Controller
{
// GET: Login
public ActionResult Index()
{
return View();
}
[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public ActionResult Login(LoginViewModel model)
{
string userName = AuthenticateUser(model.UserName, model.Password);
if (!(String.IsNullOrEmpty(userName)))
{
Session["UserName"] = userName;
return View("~/Views/Home/Default.cshtml");
}
else
{
ModelState.AddModelError("", "Invalid Login");
return View("~/Views/Home/Login.cshtml");
}
}
public string AuthenticateUser(string username, string password)
{
if(password.Equals("123")
return "Super"
else
return null;
}
public ActionResult LogOff()
{
Session["UserName"] = null;
//AuthenticationManager.SignOut();
return View("~/Views/Home/Login.cshtml");
}
}
And this is my action filter attempt:
public class AuthorizationFilter : ActionFilterAttribute
{
public override void OnActionExecuting(ActionExecutingContext filterContext)
{
if (HttpContext.Current.Session["UserName"] != null)
{
filterContext.Result = new RedirectToRouteResult(
new RouteValueDictionary{{ "controller", "MainPage" },
{ "action", "Default" }
});
}
base.OnActionExecuting(filterContext);
}
}
I have already added it to FilterConfig, but when I login it does not load Default.cshtml it just keeps looping the action filter. The action result for it looks like this:
//this is located in the MainPage controller
[AuthorizationFilter]
public ActionResult Default()
{
return View("~/Views/Home/Default.cshtml");
}
So, what would I need to add in order to give authorization so only authenticated users can view the application´s pages? Should I use Session variables or is there another/better way of doing this using? I am pretty much stuck with AuthenticateUser(), since what happens there now is just a simple comparison like the one we have there now.
Thank you for your time.

Create an AuthorizeAttribute with your logic in there:
public class AuthorizationFilter : AuthorizeAttribute, IAuthorizationFilter
{
public void OnAuthorization(AuthorizationContext filterContext)
{
if (filterContext.ActionDescriptor.IsDefined(typeof(AllowAnonymousAttribute), true)
|| filterContext.ActionDescriptor.ControllerDescriptor.IsDefined(typeof(AllowAnonymousAttribute), true))
{
// Don't check for authorization as AllowAnonymous filter is applied to the action or controller
return;
}
// Check for authorization
if (HttpContext.Current.Session["UserName"] == null)
{
filterContext.Result = new HttpUnauthorizedResult();
}
}
}
As long as you have the Login URL Configured in your Startup.Auth.cs file, it will handle the redirection to the login page for you. If you create a new MVC project it configures this for you:
public partial class Startup
{
public void ConfigureAuth(IAppBuilder app)
{
app.UseCookieAuthentication(
new CookieAuthenticationOptions {
// YOUR LOGIN PATH
LoginPath = new PathString("/Account/Login")
}
);
}
}
Using this you can decorate your controllers with [AuthorizationFilter] and also [AllowAnonymous] attributes if you want to prevent the authorization from being checked for certain Controllers or Actions.
You might want to check this in different scenarios to ensure it provides tight enough security. ASP.NET MVC provides mechanisms that you can use out of the box for protecting your applications, I'd recommend using those if possible in any situation. I remember someone saying to me, if you're trying to do authentication/security for yourself, you're probably doing it wrong.

Since your attribute is added to the FilterConfig, it will apply to ALL actions. So when you navigate to your MainPage/Default action it will be applying the filter and redirecting you to your MainPage/Default action (and so on...).
You will either need to:
remove it from the FilterConfig and apply it to the appropriate actions / controllers
or add an extra check in the filter so that it doesn't redirect on certain routes

Redirect To the log in page

I have an ASP MVC 5 web site, i have several controllers and views, how can i redirect the user aromatically to the Log-In view if he is not authenticated without preceding all the actions by if(User.Identity.Is Authenticated)

Decorate your controllers (if you want all actions within that controller to require authentication) or specific actions with the [Authorize] attribute. You can specify the login url the user gets redirected to in your web.config file.
[Authorize]
public class UserController : Controller
{
public ActionResult Index()
{
// Must be authorized
}
public ActionResult Users()
{
// Must be authorized
}
}
public class ProductController : Controller
{
public ActionResult Index()
{
// Doesn't require authorization
}
[Authorize]
public ActionResult Products()
{
// Must be authorized
}
}
Further reading:
http://msdn.microsoft.com/en-us/library/system.web.mvc.authorizeattribute(v=vs.118).aspx

For this task you can make use of the [Authorize] attribute, which you can implement at either the Class or Action level:
[Authorize]
public class AccountController : Controller
{
public AccountController () { . . . }
public ActionResult Register() { . . . }
public ActionResult Manage() { . . . }
public ActionResult LogOff() { . . . }
. . .
}
In the above instance attempting to access any action method in the controller will redirect the user to the login page, after which a further redirection to the initially requested action will be made.
For further information on how to use the Autohorize attribute please see the MSDN article, as it has expanded examples and background information.

You can use the events in the global.asax to authenticate and authorize on every request.
Application_AuthenticateRequest: Fired when the security module has established the current user's identity as valid. At this point, the user's credentials have been validated.
Application_AuthorizeRequest: Fired when the security module has verified that a user can access resources.
So, something like this (this isn't complete though)
protected void Application_AuthenticateRequest(Object sender, EventArgs e)
{
if (User.Identity.IsAuthenticated)
{
// you can re-direct them for example
}
}

Answer 1 :
You can use inbuilt [Authorize] attribute in MVC..
[Authorize]
public class YourController : Controller
{
public ActionResult YourAction()
{
}
}
the [Authorize] attribute will check whether user is authenticated or not if not then it will redirect user to login page automatically
Answer 2 :
Or you can make your custom filter attribute as :
[AuthoriseUser]
public class YourController : Controller
{
public ActionResult YourAction()
{
}
}
public class AuthoriseUserAttribute : ActionFilterAttribute
{
public override void OnActionExecuting(ActionExecutingContext filterContext)
{
// Check user is authenticated
// if user is not authenticated then do as :
filterContext.Result = new RedirectToRouteResult(new
RouteValueDictionary(new { controller = "Login", action = "Index" }));
}
}
Answer 3 :
As you have said in your comments section that you don't want to write [Authorize] attribute on every controller in your project then below answer will help you :
public class YourController : Controller
{
protected override void OnActionExecuting(ActionExecutingContext filterContext)
{
//....Check user authentication here
}
}
public class MyController : YourController
{
public ActionResult Myaction()
{
// ...
}
}
In above answer all you have to do is to make your custom base controller YourController and then you can put your authentication stuff there and then every controller in your web app will inherit YourController instead of inbuilt base Controller class.