In this recipe, you will learn how to apply authorization and authentication at global, controller, and action levels.
The authorization filter goal is to restrict action methods individually, or by controller to specific users, roles, or claims. It always runs before the action is executed:
- A classic way to use the
Authorization
filter is to add this filter at the controller level, and override with theAllowAnonymous
attribute atAction
level, as shown in the following code:
[Authorize] public class AccountController : Controller { [HttpGet] [AllowAnonymous] public IActionResult Login(string returnUrl = null) { ViewData["ReturnUrl"] = returnUrl; return View(); } [HttpGet] [AllowAnonymous] public IActionResult Register(string returnUrl = null) { ViewData["ReturnUrl"] = returnUrl; return View(); ...