Role based Menu display in cookie authentication with claims identity in asp.net core MVC?

Question

I need the best ways to do role based menu navigation. My application is in Asp.net core MVC and I have used cookie-based authentication. And I am using claims identity.

Answer 1

If you're using cookie authentication for asp.net core that means on each request you need to validate user role. Based on what role is defined in cookie in your view you show certain things. Here is how you create cookie:

FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
                        1, //ticket version
                        person.username,
                        DateTime.Now,
                        DateTime.Now.Add(new TimeSpan(2, 0, 0)),
                        true, //persistent cookies
                        "Administrator",// <---ROLES // 
                        FormsAuthentication.FormsCookiePath
                    );


string hashedTicket = FormsAuthentication.Encrypt(ticket);

HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, hashedTicket);

HttpContext.Response.Cookies.Add(cookie);

return RedirectToLocal(returnUrl);

Add that to your login/ signup mechanism

Then in your global.asax you should have following method :

protected void Application_AuthenticateRequest(object sender, EventArgs e)
    {
        // look if any security information exists for this request
        if (HttpContext.Current.User != null)
        {
            // see if this user is authenticated, any authenticated cookie (ticket) exists for this user
            if (HttpContext.Current.User.Identity.IsAuthenticated)
            {
                // see if the authentication is done using FormsAuthentication
                if (HttpContext.Current.User.Identity is FormsIdentity)
                {
                    // Get the roles stored for this request from the ticket
                    // get the identity of the user
                    FormsIdentity identity = (FormsIdentity)HttpContext.Current.User.Identity;
                    //Get the form authentication ticket of the user
                    FormsAuthenticationTicket ticket = identity.Ticket;
                    //Get the roles stored as UserData into ticket
                    string[] roles = { ticket.UserData };


                    //Create general prrincipal and assign it to current request

                    HttpContext.Current.User = new System.Security.Principal.GenericPrincipal(identity, roles);
                }
            }
        }
    }

Then in your view when you want to show certain html to admin add this:

@if (User.IsInRole("Administrator"))
{
     <li>
         <a href="@Url.Action("Index","Main",new { Area = "Admin" })">Admin</a>
     </li>
     <li>
         <a href="#" onclick="showpencil()">Edit</a>
     </li>
}

Small update If you want to filter out access in controllers just add:

[Authorize(Roles = "Administrator")] 

on class level if you want to limit all methods or add it just above single method if you want to limit only that method.