Authentication and authorization are critical components of web application security. In ASP.NET MVC, you can implement these features using built-in mechanisms such as Forms Authentication, the [Authorize] attribute, and role-based access control. This guide will walk you through the process of implementing authentication and authorization in an ASP.NET MVC application with sample code.

Step 1: Setting Up Authentication

ASP.NET MVC supports several authentication methods, but one of the most common is Forms Authentication. This method allows users to log in using a username and password. To set up Forms Authentication, follow these steps:

1. Configure Web.config

First, you need to configure the authentication settings in the Web.config file. Add the following configuration under the <system.web> section:

        
        <system.web>
            <authentication mode="Forms">
                <forms loginUrl="~/Account/Login" timeout="2880" />
            </authentication>
            <authorization>
                <deny users="?" /> <!-- Deny anonymous users -->
            </authorization>
        </system.web>
            

2. Create a Login View and Controller

Next, create a controller named AccountController to handle user login. Below is an example of a simple login action:

        
        using System.Web.Mvc;
        using System.Web.Security;

        public class AccountController : Controller
        {
            // GET: Account/Login
            public ActionResult Login()
            {
                return View();
            }

            // POST: Account/Login
            [HttpPost]
            [ValidateAntiForgeryToken]
            public ActionResult Login(LoginViewModel model)
            {
                if (ModelState.IsValid)
                {
                    // Validate user credentials (this is just a placeholder)
                    if (Membership.ValidateUser (model.Username, model.Password))
                    {
                        FormsAuthentication.SetAuthCookie(model.Username, model.RememberMe);
                        return RedirectToAction("Index", "Home");
                    }
                    ModelState.AddModelError("", "Invalid username or password.");
                }
                return View(model);
            }
        }
            

In this example:

• The Login action displays the login form.
• The POST version of the Login action validates the user credentials and sets the authentication cookie if the credentials are valid.

3. Create a Login View

Create a view named Login.cshtml for the login form:

        
        @model YourNamespace.Models.LoginViewModel

        <h2>Login</h2>

        @using (Html.BeginForm())
        {
            @Html.AntiForgeryToken()
            <div>
                @Html.LabelFor(m => m.Username)
                @Html.TextBoxFor(m => m.Username)
                @Html.ValidationMessageFor(m => m.Username)
            </div>
            <div>
                @Html.LabelFor(m => m.Password)
                @Html.PasswordFor(m => m.Password)
                @Html.ValidationMessageFor(m => m.Password)
            </div>
            <div>
                @Html.CheckBoxFor(m => m.RememberMe)
                @Html.LabelFor(m => m.RememberMe)
            </div>
            <button type="submit">Login</button>
        }
            

Step 2: Implementing Authorization

Authorization determines whether a user has permission to access a specific resource or perform a specific action. ASP.NET MVC provides several ways to implement authorization:

1. Using the [Authorize] Attribute

You can use the [Authorize] attribute to restrict access to controllers or action methods. Below is an example of using the [Authorize] attribute to protect an action:

 
        [Authorize]
        public ActionResult SecureAction()
        {
            return View();
        }
            

In this example, only authenticated users can access the SecureAction method. If an unauthenticated user attempts to access this action, they will be redirected to the login page.

2. Role-Based Authorization

You can also restrict access based on user roles. For example, to allow only users in the "Admin" role to access a specific action, you can use the following code:

        
        [Authorize(Roles = "Admin")]
        public ActionResult AdminOnly()
        {
            return View();
        }
            

This ensures that only users who belong to the "Admin" role can access the AdminOnly action.

3. Custom Authorization Attributes

If you need more complex authorization logic, you can create custom authorization attributes by inheriting from the AuthorizeAttribute class. Below is an example of a custom authorization attribute:

        
        public class CustomAuthorizeAttribute : AuthorizeAttribute
        {
            protected override bool AuthorizeCore(HttpContextBase httpContext)
            {
                // Custom authorization logic
                return httpContext.User.Identity.IsAuthenticated && 
                       httpContext.User.IsInRole("CustomRole");
            }
        }
            

You can then use this custom attribute on your actions or controllers:

        
        [CustomAuthorize]
        public ActionResult CustomSecureAction()
        {
            return View();
        }
            

Conclusion

Implementing authentication and authorization in ASP.NET MVC is straightforward with the built-in features provided by the framework. By configuring Forms Authentication, creating login functionality, and using the [Authorize] attribute, you can secure your application effectively. Additionally, role-based and custom authorization allows for fine-grained control over user access, ensuring that only authorized users can access sensitive resources.