In .Net Core, the controller attribute [AllowAnonymous] lets you set a controller to allow non-logged in users to access the controller.
Is there a way to do the opposite, to require a user to be logged in? Without giving all users a role and then checking every single controller with [Authorize(Roles = "WarmBody")], I can't see how to require a login?
You should add custom policy filter
public class Startup
{
public void ConfigureServices(IServiceCollection services)
{
services.AddMvc(config =>
{
var policy = new AuthorizationPolicyBuilder()
.RequireAuthenticatedUser()
.Build();
config.Filters.Add(new AuthorizeFilter(policy));
});
//other code ...
}
//other code ...
}
Or set [Authorize] Attribute for each controller
You don't need role based authorization, just use the [Authorize] attribute on the controller or actions you want to limit to logged in users.
https://docs.microsoft.com/en-us/aspnet/core/security/authorization/simple