4

I am using forms authentication in my ASP.NET MVC application. I want to the signup page from the authorization process. I know I can add a location tag in my main web.config file or create a new web.config inside the specific folder. But I just to exclude one specific action in the User controller. How do I do it?

DaveRandom
  • 87,921
  • 11
  • 154
  • 174
Hash
  • 821
  • 7
  • 19

5 Answers5

4

Do not use Web.config <location> authorization in an MVC application. Doing so will lead to security vulnerabilities in your web site.

Instead, use the [Authorize] attribute to control who has access to certain controllers or actions. (You can use the [Authorize] attribute on a controller's type if you want it to apply to all actions in that controller.)

More information:

Levi
  • 32,628
  • 3
  • 87
  • 88
  • Isn't there a "good" way to manage these authorization rules other than compiling them into website? I'd love to be able to tweak the rules without having to redeploy the app. – Al W Dec 16 '11 at 08:26
  • see http://blogs.msdn.com/b/rickandy/archive/2012/03/23/securing-your-asp-net-mvc-4-app-and-the-new-allowanonymous-attribute.aspx for the MVC 4 version of Levi's comments – RickAndMSFT Mar 23 '12 at 21:57
2

Try this slick way to do it.

It adds the ability to exclude Controller-level filters from an action.

[ExcludeFilter(typeof(AuthorizeAttribute)]  
public ActionMethod DontAuthorize.....

Much easier!

Community
  • 1
  • 1
Steve Potter
  • 1,899
  • 2
  • 22
  • 25
1

You could also have created your own AllowWithoutAuthorisation attribute and decorated that ActionResult with it.

EDIT This is kinda untested but couldn't you do;

[Authorize(Users="*")]

EDIT 2

Or you could decorate each ActionResult with [Authorise] and ommit the one you want not to have authorised.

griegs
  • 22,624
  • 33
  • 128
  • 205
0

OK, I have got it.

What I did is, I created a separate controller for that action and added a location element in my web.config to allow anonymous access to that action.

This will allow all access to that controller without authentication.

Hash
  • 821
  • 7
  • 19
0

Adding the [AllowAnonymous] attribute to the method (as recommended by Jeremy) worked for me as well.

Gedeon
  • 742
  • 9
  • 13