ASP.NET Web API Authorization with AuthorizeAttribute

Question

Using the new ASP.NET Web API beta. I can not seem to get the suggested method of authenticating users, to work. Where the suggested approach seems to be, to add the [Authorize] filter to the API controllers. For example:

[Authorize] 
public IEnumerable<Item> Get()
{
    return itemsService.GetItems();
}

This does not work as intended though. When requesting the resource, you get redirected to a login form. Which is not very suitable for a RESTful webapi.

How should I proceed with this? Will it work differently in future versions?, or should I fall back to implementing my own action filter?

Please, take a look at stackoverflow.com/questions/9482982/…. — paulius_l
– paulius_l, Commented Mar 2, 2012 at 10:34

Paul Tyng · Accepted Answer · 2012-03-03 02:30:31Z

96

Double check that you are using the System.Web.Http.AuthorizeAttribute and not the System.Web.Mvc.AuthorizeAttribute. This bit me before. I know the WebAPI team is trying to pull everything together so that it is familiar to MVC users, but I think somethings are needlessly confusing.

edited Mar 3, 2012 at 2:30

Paul Tyng

7,6051 gold badge36 silver badges57 bronze badges

answered Mar 2, 2012 at 23:34

AlexGad

6,7025 gold badges36 silver badges46 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Paul Tyng Over a year ago

Yeah I think this is the preferred method, didn't realize they introduced an entirely new attribute class hierarchy, I agree, confusing...

Kevin Over a year ago

Yea, they should preface every "Hello World" example with a disclaimer about the different namespace for MVC vs Web Api

Kevin Over a year ago

Yea, <superDuperBold>System.Web.Http</superDuperBold> != <superDuperBold>System.Web.Mvc</superDuperBold>

Wiktor Zychla Over a year ago

Great, glad I've found this after an hour of searching everywhere around.

Paul Tyng · Accepted Answer · 2012-03-02 13:13:56Z

Set your authentication mode to None:

<authentication mode="None" />

None Specifies no authentication. Your application expects only anonymous users or the application provides its own authentication.

http://msdn.microsoft.com/en-us/library/532aee0e.aspx

Of course then you have to provide some sort of authentication via headers or tokens or something. You could also specify Windows and use the built in auth via headers.

If this site is mixed between API and actual pages that do need the Forms setting, then you will need to write your own handling.

All the attribute does is return an HttpUnauthorizedResult instance, the redirection is done outside of the attribute, so its not the problem, its your authentication provider.

adrin · Accepted Answer · 2012-05-21 09:45:04Z

2

You are being redirected to login page because forms authentication module does this automatically. To get rid of that behavior disable forms authentication as suggested by Paul. If you want to use more REST friendly approach you should consider implementing HTTP authorization support. Take a look at this blog post http://www.piotrwalat.net/basic-http-authentication-in-asp-net-web-api-using-membership-provider/

answered May 21, 2012 at 9:45

adrin

3,8469 gold badges43 silver badges60 bronze badges

Comments

Anestis Kivranoglou · Accepted Answer · 2017-10-31 13:06:59Z

1

ASP.NET 5 Introduced the new Microsoft.AspNet.Authorization System which can secure both MVC and Web API controllers.

For more see my related answer here.

Update:

At that time 2 years ago it was Microsoft.AspNetCore.Authorization.

As @Chris Haines pointed out. now it resides on Microsoft.AspNetCore.Authorization.

From .NET core 1.0 to 2.0 many namespaces have been moved i think. And spread functionality between .net classic and core was obscure. That's why Microsoft introduced the .net standard.

.net standard

edited Oct 31, 2017 at 13:06

answered Feb 15, 2016 at 10:54

Anestis Kivranoglou

8,2545 gold badges47 silver badges48 bronze badges

2 Comments

Chris Haines Over a year ago

I think you mean Microsoft.AspNetCore.Authorization?

Anestis Kivranoglou Over a year ago

At that time 2 yers ago it was Microsoft.AspNetCore.Authorization.As you can see . nuget.org/packages/Microsoft.AspNet.Authorization From .NET core 1.0 to 2.0 many namespaces have been moved i think. And spread functionality between .net classic and core was obscure. I think that's why microsoft introduced the .net standard. learn.microsoft.com/en-us/dotnet/standard/net-standard

Community · Accepted Answer · 2017-05-23 11:54:53Z

0

Also, look at my answer for: How to secure an ASP.NET Web API

There is a NuGet package I have created which you can use for convenience.

edited May 23, 2017 at 11:54

CommunityBot

11 silver badge

answered May 20, 2013 at 3:55

Varun Chatterji

5,0991 gold badge25 silver badges24 bronze badges

Comments

Simon_Weaver · Accepted Answer · 2015-11-22 23:22:46Z

0

If you're using a Role, make sure you have it spelled correctly :

If your role is called 'Administrator' then this - for instance will not work :

    [System.Web.Http.Authorize(Roles = "Administator")]

Neither will this :

    [System.Web.Http.Authorize(Roles = "Administrators")]

Oops...

answered Nov 22, 2015 at 23:22

Simon_Weaver

147k92 gold badges688 silver badges724 bronze badges

Comments

Rahul Uttarkar · Accepted Answer · 2018-05-28 10:45:21Z

0

[Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]
[Produces("application/json")]
[Route("api/[controller]")]
public class CitiesController : Controller
{
        [HttpGet("[action]")]
        public IActionResult Get(long cityId) => Ok(Mapper.Map<City, CityDTO>(director.UnitOfWork.Cities.Get(cityId)));
}

Use

[Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]

Filter with authentication type

answered May 28, 2018 at 10:45

Rahul Uttarkar

3,6853 gold badges39 silver badges40 bronze badges

Collectives™ on Stack Overflow

ASP.NET Web API Authorization with AuthorizeAttribute

7 Answers 7

4 Comments

Comments

Comments

2 Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

7 Answers 7

4 Comments

Comments

Comments

2 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related