asp .net mvc authorization

One possible solution is to create a "protected controller" and use it as a base class for all the areas of your application that you want to protect

[Authorize]
public class ProtectedBaseController : Controller { 

}

public class AdminController : ProtectedBaseController { 
  ...
}

public class Admin2Controller : ProtectedBaseController { 
  ...
}

put [Authorisation] at the top of the controller class. that will lock down the entire controllers actions.

You can put [Authorize] to every contoller you need to secure.

You can add filter GlobalFilters.Add(new AuthorizeAttribute()); in your Startup.cs (or Global.asax) and put [AllowAnonymus] attribute to any controller or action you allow to non-registered users.

If you chose to put [Authorize] to every secure contoller you need to be sure that any controller added by you or anyone other in team will be secure. For this requirement I use such test:

[Fact]
public void AllAuth()
{
    var asm = Assembly.GetAssembly(typeof (HomeController));
    foreach (var type in asm.GetTypes())
    {
        if (typeof(Controller).IsAssignableFrom(type))
        {
            var attrs = type.GetCustomAttributes(typeof (AuthorizeAttribute));
            Assert.True(attrs.Any());
        }
    }
}

I think this way is better than a creating ProtectedContoller, because it make no guarantee that you system have all controllers secure. Also this way doesn't use inheritance, which make project heavier.

Authorization is one way to secure your application; is to apply the attribute to each controller. Another way is to use the new AllowAnonymous attribute on the login and register actions. Making secure decisions based on the current area is a Very Bad Thing and will open your application to vulnerabilities.

Code you can get here

As ASP.NET MVC 4 includes the new AllowAnonymous attribute, so you no more need to write that code.
After setting the AuthorizeAttribute globally in global.asax and then whitelisting will be sufficient. This methods you want to opt out of authorization is considered a best practice in securing your action methods. Thanks.

[Area("AdminPanel")]
public class TestimonialsController : Controller
{
    private  AppDbContext _context;
    private IWebHostEnvironment _env;
    public TestimonialsController(AppDbContext context, IWebHostEnvironment env)
    {
        _context = context;
        _env = env;
    }
    public IActionResult Index()
    {
        return View(_context.Testimonials);
    }
    // GET: AdminPanel/Testimonials/Create
    public IActionResult Create()
    {
        return View();
    }

    // POST: AdminPanel/Testimonials/Create
    [HttpPost]
    [ValidateAntiForgeryToken]
    public async Task<IActionResult> Create(Testimonial testimonial)
    {
        if (!ModelState.IsValid)
        {
            return View();
        }
        if (!testimonial.Photo.CheckFileType("image/"))
        {
            return View();
        }
        if (!testimonial.Photo.CheckFileSize(200))
        {
            return View();
        }


        testimonial.Image = await testimonial.Photo.SaveFileAsync(_env.WebRootPath, "images");
        await _context.Testimonials.AddAsync(testimonial);
        await _context.SaveChangesAsync();
        return RedirectToAction(nameof(Index));
    }

    // GET: AdminPanel/Testimonials/Edit/5
    public async Task<IActionResult> Update(int? id)
    {
        if (id == null)
        {
            return BadRequest();
        }
        var testimonial = await _context.Testimonials.FindAsync(id);
        if (testimonial == null)
        {
            return NotFound();
        }
        return View(testimonial);
    }

    // POST: AdminPanel/Testimonials/Edit/5
    [HttpPost]
    [ValidateAntiForgeryToken]
    public async Task<IActionResult> Update(int? id, Testimonial newtestimonial)
    {
        if (id==null)
        {
            return BadRequest();
        }
        var oldtestimonial = _context.Testimonials.Find(id);
        if (oldtestimonial == null)
        {
            return NotFound();
        }
        if (!ModelState.IsValid)
        {
            return View();
        }
        if (!newtestimonial.Photo.CheckFileType("image/"))
        {
            return View();
        }
        if (!newtestimonial.Photo.CheckFileSize(200))
        {
            return View();
        }
        var path = Helper.GetPath(_env.WebRootPath, "images", oldtestimonial.Image);
        if (System.IO.File.Exists(path))
        {
            System.IO.File.Delete(path);
        }
        newtestimonial.Image = await newtestimonial.Photo.SaveFileAsync(_env.WebRootPath, "images");
        oldtestimonial.Image = newtestimonial.Image;
        await _context.SaveChangesAsync();
        return RedirectToAction(nameof(Index));
    }
    public async Task<IActionResult> Delete(int id)
    {
        if (id == null)
        {
            return BadRequest();
        }

        var testimonial = _context.Testimonials.Find(id);
        if (testimonial == null)
        {
            return NotFound();
        }
        var path = Helper.GetPath(_env.WebRootPath, "images", testimonial.Image);
        if (System.IO.File.Exists(path))
        {
            System.IO.File.Delete(path);
        }
        _context.Testimonials.Remove(testimonial);
        await _context.SaveChangesAsync();
        return RedirectToAction(nameof(Index));
    }

}

}