ASP.NET MVC Roles Authorization

18
votes

I want to make the roles default for my controller class to "Administrators, Content Editors"

[Authorize(Roles = "Administrators, Content Editor")]

I've done this by adorning the controller with the attribute above. However, there is one action that I want to be available to all (namely "View"). How can I reset the Roles so that everyone (including completely unauthorized users) have access for this action.

Note: I know I could adorn every single action other action with the authorize attribute above but I don't want to have to do that all the time. I want all of the controllers actions to be unacessible by default so that if anyone adds an action they have to make a considered decision to make it available to the general public.

3
asp.net-mvcauthorizationroles
So are you wanting something like https://stackguides.com/questions/780436? – dave
Yup - looks about right ... wish this was inbuilt to the std controllers but not a big effort to code for. Thanks for linking me up. – Mr Grok
possible duplicate of ASP MVC Authorize all actions except a few – Matt

3 Answers

16
votes

MVC4 has a new attribute exactly meant for this [AllowAnonymous]

[AllowAnonymous]
public ActionResult Register()

http://blogs.msdn.com/b/rickandy/archive/2012/03/23/securing-your-asp-net-mvc-4-app-and-the-new-allowanonymous-attribute.aspx

4
votes

You can place the Authorize attribute on the action methods. Not just at the class level.

So, move the attribute from the controller class to just the action methods you want to secure.

0
votes

The only solution I can think of so far is to create and register another controller so that I have one for anonymous access, and one for authorized access but that's not quite as elegant as I would have liked.