Securing the entire ASP.NET 5 MVC 6 application

Question

If I want to protect a specific section in my MVC application, I use [Authorize] for ActionMethod. I also know that I can use it for the entire controller, so I do not need to specify it for every ActionMethod in it.

I want to require authorization around the world and I want to allow anonymous users in just a few places. How do I allow users to log in all over the world and allow anonymous users to use several ActionMethods?

Answer 1

You can simply register AuthorizeFilter globally in Startup.cs :

 public void ConfigureServices(IServiceCollection services) { // configure/build your global policy var policy = new AuthorizationPolicyBuilder() .RequireAuthenticatedUser() .Build(); services.AddMvc(x => x.Filters.Add(new AuthorizeFilter(policy))); } 

(Actual policy building bits were taken from @Sam's own answer)

Answer 2

Here's the answer ... In the Startup class, ConfigureServices :

 public void ConfigureServices(IServiceCollection services) { // Add framework services. services.AddMvc(options => { options.Filters.Add(new AuthorizeFilter(new AuthorizationPolicyBuilder().RequireAuthenticatedUser().Build())); }); }