ASP.NET MVC 5: “Authorization” by default for your web app

0 0 votes
Article Rating

Securing your MVC app is a tricky business! Although security is a huge topic, one of the problems that you might encounter is that unauthenticated users are allowed by default to execute every action in your web app. This behaviour is potentially unsafe because you have to remember to decorate your actions with the authorize attribute each and every time, and humans are of course prone to errors!

This is why, I would suggest, authentication to be enforced by default, or differently [Authorize] attribute should be added behind the scenes to every action.

Thankfully, you can use global filters to do that!
Open App_Start folder, double click on FilterConfig.cs and add as a global filter the AuthorizeAttribute() like this:

This way, every controller and action needs authorization before executing its code. The only thing you have to remember, is to allow access wherever you want (e.g. login actio ) using the AllowAnonymous attribute:

0 0 votes
Article Rating
Notify of
Newest Most Voted
Inline Feedbacks
View all comments

[…] my previous post, i wrote about how to protect your web app from human mistakes, by enforcing authentication by […]

[…] a previous post, I wrote about how to protect your web app from human errors by enforcing authentication by […]