What does [Authorize(Users = "*")] mean in asp.net mvc.? Also please explain [Authorize(Users = "")] and [Authorize(Users = "?")].
Thanks.
Add a comment
|
3 Answers
To authorize all users, just omit using the [Authorize] attribute alltogether. To authorize authenticated users, use the [Authorize] attribute. To authorize specific roles or users, that is when you'll have [Authorize (Users = "someuser")] or [Authorize (Roles = "somerole")].
5 Comments
Muthukumar
I tried [Authorize(Users = "*")] to a Action. It does not even allow authenticated users. When i add just [Authorize], it allows the authenticated users.
Yablargo
Thanks folks. I fell into the same pitfall as the OP
Looking at the documentation for the attribute it doesn't look like you can use it that way. By default the AuthorizeAttribute only allows access to authenticated and authorised users so passing * (all) or ? (guest) doesn't make sense.
The Users property is used to further restrict the list of authenticated users who can access the Action method along with the Roles property which can also be used to further filter any authenticated access.
1 Comment
Muthukumar
A peculiar thing is that when i use [Authorize(Users = "")] , it just allows authenticated users.
I think the second post is correct, in [Authorize(Users = " * ")] the " * " part doesn't make any sense (in the web.config it does but that is something completely different).
