Authorize, except for some of the html page

Question

In web api project (with angularjs on the client side) I used Authorize attribute for web api controllers and websecurity class for user authentication in AccountController.

My HomeController looks like this:

public class HomeController : Controller
{
    [Authorize]
    public ActionResult Index()
    {
        ViewBag.Title = "Home Page";

        return View();
    }
}

My Index.cshtml (razor page) for Home controller looks like this:

<div ng-view>
</div>

In _Layout.cshtml, I defined angular app.

In web config, I use Forms Authentication, which looks like this:

<authentication mode="Forms">
  <forms loginUrl="~/Account/Login" timeout="2880"/>
</authentication>

For most of web api controllers I used [Atuthorize] attribute for methods. For some of the controllers I used [AllowAnonymous] attribute and it's fine (have access for web api services and get json result).

My app.js which uses angular and contains routing for my pages looks like this:

var myApp = angular.module("myApp", ['ngRoute', 'angular.morris', 'angularUtils.directives.dirPagination'])
.config(function ($routeProvider, $locationProvider) {
    $routeProvider
    .when('/', {
        templateUrl: 'Template/Dashboard.html',
        controller: 'dashboardController'
    })
    .when('/Page1/', {
        templateUrl: 'Template/Page1.html',
        controller: 'page1Controller'
    })
    .when('/Page2/', {
        templateUrl: 'Template/Page2.html',
        controller: 'page2Controller'
    })
    .when('/Page3/', {
        templateUrl: 'Template/Page3.html',
        controller: 'page3Controller'
    })
    .when('/Page4/', {
        templateUrl: 'Template/Page4.html',
        controller: 'page4Controller'
    })
    .when('/Page5/', {
        templateUrl: 'Template/Page5.html',
        controller: 'page5Controller'
    })
    .otherwise('/', {
        templateUrl: 'Template/Dashboard.html',
        controller: 'dashboardController'
    });
})

When run application, then display Log In page. (It's good).

Is there any solution, that when I write localhost:12345/#/Page2 (when I am not logged on the application) on browser that redirect me to this page (without user authentication)? Now, always redirect me to Login Page.

When you go to `localhost:12345/#/Page2`, the server only gets `localhost:12345/`, so no — Camilo Terevinto, Jun 13 '18 at 12:00
No, always redirect me to Login Page. Actually, I want to access this page (localhost:12345/#/Page2) without authentication. — oknevermind, Jun 13 '18 at 12:03
Then you would have to remove `[Authorize]` from the `Index` action, which would make it entirely unsecured — Camilo Terevinto, Jun 13 '18 at 12:03
When I remove [Authorize] on the Index.cshtml page, then authentication not working (not start Login page). When I run project, then redirect me to Dashboard. — oknevermind, Jun 13 '18 at 12:08
That's what i said. You either authorize always or never. You cannot use a front-end action to determine a back-end logic. Either use another URL (like `localhost:12345/public`) or use a custom `Authorize` attribute — Camilo Terevinto, Jun 13 '18 at 12:09

Authorize, except for some of the html page

0 Answers0