3

How can I disable authentication during development for controllers that have an [Authorize] attribute? Here is an answer for .net core 2, but it uses AddMvc() which isn't in use in .net core 3.0.

I tried this:

    services.AddControllers().AddMvcOptions(opts => opts.Filters.Add<AllowAnonymousFilter>());

It still returned a 401; I don't know if that's even on the right track.

Update:

The previously linked post has been updated with answers that work with 3.x.

Asp.net "disable" authentication in development environment

3
  • services.AddMvc() is in .net core 3.0 under the extension MvcServiceCollectionExtensions. You can use same approach as in .net core 2 to achieve what you need. Nov 25, 2019 at 15:26
  • @Venky It doesn't actually work, likely because the rest of the application is not set up in the AddMvc pattern. Even if it did, I would feel uncomfortable using it because AddMvc seems to no longer be a recommended pattern, and has been replaced, in this case, by AddControllers.
    – stellr42
    Nov 25, 2019 at 16:06
  • 1
    Applying the [AllowAnonymous] filter as a way to ease development is really not a good idea since you are skipping important parts of your application while not providing the information you may rely on when the user is actually authenticated. So it is a better idea to sign in as a synthetic user that contains the claims you need and have the authorization work as desired.
    – poke
    Nov 25, 2019 at 16:49

3 Answers 3

2

Just go to launchSettings.json in your project:

1

then set "anonymousAuthentication" to "true".

1

You could try something like this.

public class Startup 
{
   public Startup(IConfiguration configuration, IWebHostEnvironment env)
   {
            Configuration = configuration;
            Environment = env;
   }

   public Microsoft.AspNetCore.Hosting.IWebHostEnvironment Environment { get; }

   public void ConfigureServices(IServiceCollection services)
   {
            services.AddControllers(opts =>
            {
                if (Environment.IsDevelopment())
                {
                    opts.Filters.Add<AllowAnonymousFilter>();
                }
                else
                {
                  var authenticatedUserPolicy = new AuthorizationPolicyBuilder()
                            .RequireAuthenticatedUser()
                            .Build();
                  opts.Filters.Add(new AuthorizeFilter(authenticatedUserPolicy)); 
                 }
            });
    }

} 
1
  • Thanks, this does work. My only issue with it is that it applies authorization to every controller, instead of allowing more fine-grained control of where to apply the [Authorize] attribute. I would still appreciate a solution that works more similarly to the .net core 2 method.
    – stellr42
    Nov 25, 2019 at 18:17
0

How about automatically logging the user in with "test" Claim information when in development. For example, let's say when you are in non-development environments you use something like below to authorize a user:

// Checked the database and user is legit so populate the claims
// Create the identity for the user. userList is var or list populated from database. userEmail is the user's email or some other identifier.
identity = new ClaimsIdentity(new[] {
    new Claim(ClaimTypes.Name, userList.fullname),
    new Claim(ClaimTypes.Role, userList.userrole),
    new Claim(ClaimTypes.NameIdentifier, userEmail),
}, CookieAuthenticationDefaults.AuthenticationScheme);

var principal = new ClaimsPrincipal(identity);
var login = HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, principal);
return RedirectToAction("Index", "Home");

When you are in development you can do something like:

// You may need to inject Microsoft.AspNetCore.Hosting.IHostingEnvironment. I use .Net core 2.2 so not sure about 3.
if (env.EnvironmentName == "Development")
{
    // In Development so create "test" claim information and automatically authorize the user
    // Create the identity for the user
    identity = new ClaimsIdentity(new[] {
    new Claim(ClaimTypes.Name, "Test User"),
    new Claim(ClaimTypes.Role, "Tester"),
    new Claim(ClaimTypes.NameIdentifier, "[email protected]"),
    }, CookieAuthenticationDefaults.AuthenticationScheme);

    // Populate the session user name
    HttpContext.Session.SetString(SessionUserName, userList.fullname);

    var principal = new ClaimsPrincipal(identity);
    var login = HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, principal);
    return RedirectToAction("Index", "Home");
}

3
  • I don't want to do this because the authentication is handled by a different project; this project is only a consumer. I'm looking for a way to simply bypass the [Authorize] attribute as is shown in the linked question for .net core 2.
    – stellr42
    Nov 25, 2019 at 15:17
  • Perhaps I'm missing something. If you are able to bypass authentication for a project that you don't control isn't that a big security issue? Are you looking to exploit a vulnerability? Would it be better to ask the creator of that other project to create a role or add simple logic for development? Nov 25, 2019 at 16:02
  • I control my project, but it doesn't do any of the work in adding claims or creating users. My project only reads the existing claims off of a cookie, which doesn't require any claims based work. I therefore don't want to start adding irrelevant claims code into my project.
    – stellr42
    Nov 25, 2019 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.