ASP.NET MVC Forms authentication and unauthenticated controller actions

Question

I have a ASP.NET MVC site that is locked down using Forms Authentication. The web.config has

Answer 1

Yes you can. In your AccountController there's an [Authorize]-attribute either on class-level (to make the whole controller restricted) or on specific methods.

To make specific actions restricted you simply use the Authorize-attribute on the methods that handle these actions, and leave the controller-class unrestricted.

Here are a few examples... hope it helps

To require users to login, use:

[Authorize]
public class SomeController : Controller

// Or
[Authorize]
public ActionResult SomeAction()

To restrict access for specific roles, use:

[Authorize(Roles = "Admin, User")]
public class SomeController : Controller

// Or
[Authorize(Roles = "Admin, User")]
public ActionResult SomeAction()

And to restrict access for specific users, use:

[Authorize(Users = "Charles, Linus")]
public class SomeController : Controller

// Or
[Authorize(Users = "Charles, Linus")]
public ActionResult SomeAction()

As you can see, you can either use the attribute at class-level or at method-level. Your choice!

Answer 2

Instead of securing all resources on your website by default and then looking for a way to provide anonymous access for individual resources, you're probably better off taking the opposite approach. Don't specify authorization rules in your web.config, then use Authorization filters (see Mickel's answer) to secure individual controllers and/or actions.

Answer 3

I don't think there is an "Unauthorize" attribute that can be applied to actions and if you don't want to place "[Authorize]" on all but two actions in a controller try the following:

Here are two methods I can think of:

1- Location attribute in Web.config (Not sure if this will work with MVC routing etc.)

After your

<system.web> stuff </system.web>

in web.config file, add the following:

  <location path="Account/ActionOne">
     <system.web>
           <authorization>
              <allow users ="*" />
          </authorization>
      </system.web>
  </location>

Where Account/ActionOne is the name of the action method you want to give anonymous access to. For the second Action, copy the above code and paste it right after it and change the name of the Action.

I'm not sure if this will work because of MVC routing etc, but give it a try.

2- Base Controller

If the previous solution didn't work, your best bet would be to create a base controller that is decorated with the Authorize attribute:

[Authorize]
public class AuthorizeControllerBase : Controller {}

Then have all your controllers inherit from it:

public class AccountController : AuthorizeControllerBase
{
      // your actions etc.
}

This will make any controller that inherits from AuthorizeControllerBase require authorization/logging in to invoke any methods.

Then you would need to remove from your web.config