Asp.Net Mvc Authorization Filters Complete Guide

Step 1: Setting Up an ASP.NET MVC Project

First, let's create a new ASP.NET MVC project in Visual Studio.

1. Open Visual Studio.
2. Create a New Project:
   • Go to File > New > Project.
   • Select ASP.NET Web Application (.NET Framework) and give it a name (e.g., MvcAuthFilterDemo).
   • Choose MVC as the project template and click Create.

Step 2: Creating a Simple Model

For demonstration purposes, let's create a simple User model.

1. Add a Model Class:
   • Right-click on the Models folder in the Solution Explorer.
   • Select Add > Class.
   • Name the class User.cs and add the following code:

using System.ComponentModel.DataAnnotations;

namespace MvcAuthFilterDemo.Models
{
    public class User
    {
        [Key]
        public int Id { get; set; }

        [Required]
        [StringLength(50)]
        public string Username { get; set; }

        [Required]
        [StringLength(50)]
        public string Password { get; set; }

        [Required]
        [StringLength(50)]
        public string Role { get; set; }
    }
}

Step 3: Creating a Users Table and Seeding Data

We will create a Users table in the database and seed it with some users for demonstration.

1. Add a DbContext Class:
   • Right-click on the Models folder.
   • Select Add > Class.
   • Name the class ApplicationDbContext.cs and add the following code:

using System.Data.Entity;

namespace MvcAuthFilterDemo.Models
{
    public class ApplicationDbContext : DbContext
    {
        public ApplicationDbContext() : base("DefaultConnection")
        {
        }

        public DbSet<User> Users { get; set; }

        // Seed Data
        protected override void Seed(ApplicationDbContext context)
        {
            base.Seed(context);

            context.Users.AddOrUpdate(u => u.Username,
                new User { Id = 1, Username = "admin", Password = "admin123", Role = "Admin" },
                new User { Id = 2, Username = "user", Password = "user123", Role = "User" }
            );
        }
    }
}

2. Configure the Connection String:
   • Open Web.config and make sure the DefaultConnection is correctly configured:

<connectionStrings>
    <add name="DefaultConnection" connectionString="Data Source=(LocalDb)\MSSQLLocalDB;Initial Catalog=MvcAuthFilterDemo;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|\MvcAuthFilterDemo.mdf" providerName="System.Data.SqlClient" />
</connectionStrings>

3. Enable Migrations and Update the Database:
   • Open the Package Manager Console in Visual Studio (Tools > NuGet Package Manager > Package Manager Console).
   • Run the following commands:

Enable-Migrations
Add-Migration InitialMigration
Update-Database

Step 4: Creating a Custom Authorization Filter

Now, let's create a custom authorization filter to check user roles.

1. Add a Filter Class:
   • Right-click on the Filters folder in the Solution Explorer.
   • Select Add > Class.
   • Name the class CustomAuthorizeAttribute.cs and add the following code:

using System;
using System.Linq;
using System.Web;
using System.Web.Mvc;
using MvcAuthFilterDemo.Models;

namespace MvcAuthFilterDemo.Filters
{
    public class CustomAuthorizeAttribute : ActionFilterAttribute, IAuthorizationFilter
    {
        private readonly ApplicationDbContext _context = new ApplicationDbContext();
        private readonly string[] _roles = null;

        public CustomAuthorizeAttribute(params string[] roles)
        {
            _roles = roles;
        }

        public void OnAuthorization(AuthorizationContext filterContext)
        {
            if (filterContext == null)
            {
                throw new ArgumentNullException(nameof(filterContext));
            }

            if (SkipAuthorization(filterContext))
            {
                return;
            }

            if (_roles.Length == 0)
            {
                filterContext.Result = new HttpUnauthorizedResult();
                return;
            }

            var username = filterContext.HttpContext.User.Identity.Name;
            var user = _context.Users.FirstOrDefault(u => u.Username == username);

            if (user == null || !_roles.Contains(user.Role))
            {
                filterContext.Result = new HttpUnauthorizedResult();
            }
        }

        private bool SkipAuthorization(AuthorizationContext filterContext)
        {
            var allowAnonymous = filterContext.ActionDescriptor
                .GetCustomAttributes(inherit: true)
                .OfType<AllowAnonymousAttribute>()
                .Any();

            return allowAnonymous;
        }
    }
}

Step 5: Applying the Custom Authorization Filter

Let's apply the custom authorization filter to some controllers and actions.

1. Add a Login Controller:
   • Right-click on the Controllers folder.
   • Select Add > Controller.
   • Choose MVC 5 Controller - Empty and name it LoginController.cs.

using System.Web;
using System.Web.Mvc;
using MvcAuthFilterDemo.Models;

namespace MvcAuthFilterDemo.Controllers
{
    public class LoginController : Controller
    {
        private readonly ApplicationDbContext _context = new ApplicationDbContext();

        [HttpGet]
        public ActionResult Index()
        {
            return View();
        }

        [HttpPost]
        public ActionResult Index(string username, string password)
        {
            var user = _context.Users.FirstOrDefault(u => u.Username == username && u.Password == password);
            if (user != null)
            {
                FormsAuthentication.SetAuthCookie(username, false);
                return RedirectToAction("Index", "Home");
            }

            ModelState.AddModelError("", "Invalid username or password.");
            return View();
        }

        public ActionResult Logout()
        {
            FormsAuthentication.SignOut();
            return RedirectToAction("Index", "Login");
        }
    }
}

2. Add a Home Controller:
   • Right-click on the Controllers folder.
   • Select Add > Controller.
   • Choose MVC 5 Controller - Empty and name it HomeController.cs.

using System.Web.Mvc;

namespace MvcAuthFilterDemo.Controllers
{
    [CustomAuthorize("Admin", "User")]
    public class HomeController : Controller
    {
        public ActionResult Index()
        {
            return View("Index", "Home");
        }
    }
}

3. Add an Admin Controller:
   • Right-click on the Controllers folder.
   • Select Add > Controller.
   • Choose MVC 5 Controller - Empty and name it AdminController.cs.

using System.Web.Mvc;

namespace MvcAuthFilterDemo.Controllers
{
    [CustomAuthorize("Admin")]
    public class AdminController : Controller
    {
        public ActionResult Index()
        {
            return View("Index", "Admin");
        }
    }
}

Step 6: Creating Views

Let's create some simple views for the controllers.

1. Create Views for Home Controller:
   • Right-click inside the Index action of HomeController.
   • Select Add View.
   • Name the view Index and click Add.

@{
    ViewBag.Title = "Home Page";
}

<h2>Welcome to the Home Page!</h2>
<p>Your role is: @User.Identity.Name</p>
<a href="@Url.Action("Index", "AdminController")">Go to Admin Page</a>
<a href="@Url.Action("Logout", "Login")">Logout</a>

2. Create Views for Admin Controller:
   • Right-click inside the Index action of AdminController.
   • Select Add View.
   • Name the view Index and click Add.

@{
    ViewBag.Title = "Admin Page";
}

<h2>Welcome to the Admin Page!</h2>
<p>Your role is: @User.Identity.Name</p>
<a href="@Url.Action("Index", "HomeController")">Go to Home Page</a>
<a href="@Url.Action("Logout", "Login")">Logout</a>

3. Create a Login View:
   • Right-click inside the Index action of LoginController.
   • Select Add View.
   • Name the view Index and click Add.

@{
    ViewBag.Title = "Login";
}

<h2>Login</h2>

@using (Html.BeginForm())
{
    <div>
        <label for="username">Username:</label>
        <input type="text" name="username" required />
    </div>
    <div>
        <label for="password">Password:</label>
        <input type="password" name="password" required />
    </div>
    <div>
        <input type="submit" value="Login" />
    </div>
}

@section Scripts {
    @Scripts.Render("~/bundles/jqueryval")
}

@foreach (var error in ViewBag.Errors as List<string> ?? new List<string>())
{
    <p style="color: red">@error</p>
}

Step 7: Configuring Forms Authentication

Enable forms authentication in Web.config:

<authentication mode="Forms">
    <forms loginUrl="~/Login/Index" timeout="2880" />
</authentication>
<authorization>
    <deny users="?" />
</authorization>

Step 8: Testing the Application

1. Run the Application:

   • Press F5 to start the application.
   • You should be redirected to the login page.

2. Login:

   • Use the following credentials to log in:
     • Username: admin
     • Password: admin123

3. Accessing Pages:

   • Once logged in, you should be able to access the Home and Admin pages.
   • Try logging in with the user account and attempt to access the Admin page. You should be denied access.

Final Notes

• Customization:

  • You can customize the CustomAuthorizeAttribute to include more complex logic, such as checking permissions in a database or external service.

• Best Practices:

  • Always use secure methods for storing and verifying passwords, such as hashing with salts.
  • Consider using frameworks like Identity for more advanced authentication and authorization needs.