Using the Authorize Attribute with Custom Cookie Authentication in ASP.NET Core

rgvassar

I have the following code in Startup.cs:

public void ConfigureServices(IServiceCollection services)
{
    //Other middleware
    services.AddAuthentication(options =>
    {
        options.SignInScheme = "MyAuthenticationScheme";
    });

    services.AddAuthorization();
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
    //Other configurations.
    app.UseCookieAuthentication(options =>
    {
        options.AuthenticationScheme = "MyAuthenticationScheme";
        options.LoginPath = new PathString("/signin/");
        options.AccessDeniedPath = new PathString("/signin/");
        options.AutomaticAuthenticate = true;
    });
}

Then just for testing purposes, I have a login page where you just click a button and it posts back to itself, with this code in the controller.

SignInController.cs

public IActionResult Index()
{
    return View();
}

[HttpPost]
[AllowAnonymous]
public async Task<IActionResult> Index(SignInViewModel model)
{
    List<Claim> claimList = new List<Claim>();
    claimList.Add(new Claim("Admin", "true"));
    ClaimsIdentity identity = new ClaimsIdentity(claimList);
    ClaimsPrincipal principal = new ClaimsPrincipal(identity);
    await HttpContext.Authentication.SignInAsync("MyAuthenticationScheme", principal);
    return RedirectToAction(nameof(HomeController.Index), "Home");
}

Here's the HomeController.cs

[Authorize]
public async Task<IActionResult> Index()
{
    return View();
}

I get 401 unauthorized. From my understanding the SignInAsync call should authenticate the user, and the the [Authorize] attribute should allow any authenticated users. If I do something like this in HomeController.cs:

ClaimsPrincipal cp = await HttpContext.Authentication.AuthenticateAsync("MyAuthenticationScheme");

I can see that cp does contain the Admin claim that I gave it earlier. I would think that meant the user was successfully authenticated. Why isn't the [Authorize] attribute working?

Joe Audette

I think you need to specify the authscheme in the constructor of the identity, your code should be more like this:

var authProperties = new AuthenticationProperties();
var identity = new ClaimsIdentity("MyAuthenticationScheme");
identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, "1"));
identity.AddClaim(new Claim(ClaimTypes.Name, "Admin"));
var principal = new ClaimsPrincipal(identity);
await HttpContext.Authentication.SignInAsync(
            "MyAuthenticationScheme", 
            claimsPrincipal, 
            authProperties);
return RedirectToAction(nameof(HomeController.Index), "Home");

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

Custom Authorize attribute - ASP .NET Core 2.2

Asp.net Core Persistent Authentication - Custom Cookie Authentication

Return HTTP 403 using Authorize attribute in ASP.Net Core

Custom Authorize Attribute on asp.net mvc

Custom Authorize Attribute not working asp.net

ASP.NET Core 2.0 HttpSys Windows Authentication fails with Authorize attribute (InvalidOperationException: No authenticationScheme was specified)

JWT Authentication using a custom attribute in .NET Core Web API

Redirect to login with attribute Authorize using cookies authentication in ASP.NET 5

How [Authorize] attribute get to know that the user is authenticate in ASP.NET MVC, is it by using authentication token?

How do I create a custom Authorize attribute that does not depend on claims in ASP.NET Core?

Custom Authorization attribute doesn't allow authorize in asp.net core 3

Use cookie, authorize attribute, create session for application in .net core 2.1

Cookie Authentication ASP.NET Core

ASP.Net Core Cookie Authentication is not persistant

Custom Authentication using legacy user table in Asp.Net Core

Not Found for actions with Authorize attribute while using identity in asp.net core

Using Asp.Net Core Identity in MVC, Authorize attribute is rebouncing to login page after succesfull login

Why is the Authentication Cookie not working against the [Authorize] attribute?

SignalR Authorize attribute does not work with cookie authentication

setting asp.net CORE 2 authentication cookie while using bearer token authentication

ASP.NET Core 3 API Ignores Authorize Attribute with Bearertoken

What is the default behavior of violating the Authorize attribute in ASP.NET Core

Asp.net Core MVC Authorize Attribute not blocking

ASP.NET Core Authorize attribute not working with JWT

Asp.Net Core Identity - Authorize attribute with roles and caching?

Asp.Net Core WebApi: Authorize attribute Error 403

Generic Authorize Attribute multiple Roles ASP.NET Core

ASP.NET Core 2.0 Preview 1: How to set up Cookie Authentication with custom login path

Cookie authentication not working properly with JWT authentication ASP.NET CORE