How to check if user is authorized inside Action

Question

Usually I protect my Actions with [Authorize] but this time I need to check if a user is authorized inside the action.

Eg

if(userIsAuthorized) {
    //do stuff
}
else {
    //return to login page
}

~~I believe~~ I am using 'Forms Authentication'

This question is kind of similar to this but none of the answers given seemed to work.

EDIT: I have done some more digging- it seems if I breakpoint on an Action that has [Authorize], the User.Identity is set, but on Actions without it, the User.Identity is empty, even if I am logged in

I have fixed my issue by using a hack-ish workaround, I am going to assume your answers are all correct and it is due to my strange implementation of authentication that things are strange... — elwyn
– elwyn, Commented Feb 5, 2010 at 3:46

Aaronaught · Accepted Answer · 2010-02-05 03:27:52Z

59

If you just want to know if the user is logged in:

if (User.Identity.IsAuthenticated) { ... }

If you are trying to do anything role-specific:

if (User.IsInRole("Administrators")) { ... }

The User instance is a public property of the Controller class, so you always have access to it from a Controller you write. If no user is logged in you should have a GenericPrincipal for the User and a GenericIdentity for the User.Identity, so don't worry about checking for nulls.

answered Feb 5, 2010 at 3:27

Aaronaught

123k26 gold badges273 silver badges344 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

elwyn Over a year ago

Again, only gives me 'true' if used within an [Authorize]'d Action

Aaronaught Over a year ago

@elwyn: I don't believe that's correct. I just tested it here on an action without the [Authorize] attribute and User.Identity.IsAuthenticated is true. Are you sure that the session is actually logged in when you are testing this?

elwyn Over a year ago

@Aaronaught Yes, just double (triple) checked, definantly logged in while trying that, and still see false

elwyn Over a year ago

-----In my non-[Authorize]'d Action: User.Identity {System.Security.Principal.GenericIdentity} [System.Security.Principal.GenericIdentity]: {System.Security.Principal.GenericIdentity} AuthenticationType: "" IsAuthenticated: false Name: "" -----In an Authorized one: User.Identity {System.Web.Security.FormsIdentity} [System.Web.Security.FormsIdentity]: {System.Web.Security.FormsIdentity} AuthenticationType: "Forms" IsAuthenticated: true Name: "admin"

Aaronaught Over a year ago

@elwyin: Nothing I can do reproduces the behaviour that you seem to be seeing. You do not need the [Authorize] attribute for User and User.Identity to be valid. Do you have any other attributes on the Controller? Have you tried doing this in a new, clean MVC project, to make sure that nothing else in your app is interfering?

Esteban Araya · Accepted Answer · 2010-02-05 03:23:40Z

6

Request.IsAuthenticated should work for what you're trying to do.

answered Feb 5, 2010 at 3:23

Esteban Araya

29.8k26 gold badges112 silver badges141 bronze badges

1 Comment

elwyn Over a year ago

If I do that on an Action decorated with [Authorize] it works fine, however if I do that on this Action (not decorated with [Authorize]) it is always false, regardless of whether I am logged in or not.

John Farrell · Accepted Answer · 2010-02-05 03:05:01Z

1

I suggest first figuring out what kind of Authorization your using. ;)

The answer you posted is correct. From what I remember poking around the [Authorize] attribute and related ActionFilter code MVC internally calls Page.User.Identity.IsAuthenticated just like those code examples.

answered Feb 5, 2010 at 3:05

John Farrell

24.7k10 gold badges82 silver badges112 bronze badges

1 Comment

elwyn Over a year ago

Double checked and it is Forms Authentication

messed-up · Accepted Answer · 2017-04-21 17:03:27Z

Create an attribute like this: OnActionExecuting will get executed first before other code from the action

     public class IsAuthenticatedAttribute : ActionFilterAttribute
        {
            public override void OnActionExecuting(ActionExecutingContext filterContext)
            {
               //do your validations here. and redirect to somewhere if needed. 
                filterContext.HttpContext.Response.Redirect("/") //this will send user to home.
            }
        }

on each action where you need to check, add attribute like this:

[IsAuthenticatedAttribute]
public ActionResult ActionName(parameters?)
{
     // no need to worry about checking here.
    //do you action things
}

EDIT: This one still completes the action and then only redirect it. Not so much useful.

Trần Hữu Hiền · Accepted Answer · 2020-11-03 09:27:38Z

0

Put annotation [Authorize] in every your Action. Microsoft link. Example:

public class AdministrationController : Controller
{
     // GET: User/Create
       [Authorize]
        public ActionResult Create()
        { 
     }
}

answered Nov 3, 2020 at 9:27

Trần Hữu Hiền

1,0541 gold badge13 silver badges24 bronze badges

Collectives™ on Stack Overflow

How to check if user is authorized inside Action

5 Answers 5

5 Comments

1 Comment

1 Comment

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

5 Comments

1 Comment

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related