73

Is it possible to "disable" authentication in ASP.NET Core application without changing its logic?

I have a .net website which uses an external identity server app for authentication. Anyway I would like to be able to mock the authentication when I'm developing it (ASPNETCORE_ENVIRONMENT = Development), airing access to all actions ignoring the authorization attributes.

Is it possible to do it just mocking some services in the service collection?

8 Answers 8

68

On updating to net core 3.1, the mvc AllowAnonymousFilter was not working for us any more. We found conditionally adding a custom IAuthorizationHander to be the simplest way forward to conditionally bypass auth.

eg.

/// <summary>
/// This authorisation handler will bypass all requirements
/// </summary>
public class AllowAnonymous : IAuthorizationHandler
{
    public Task HandleAsync(AuthorizationHandlerContext context)
    {
        foreach (IAuthorizationRequirement requirement in context.PendingRequirements.ToList())
            context.Succeed(requirement); //Simply pass all requirements
        
        return Task.CompletedTask;
    }
}

Then register this handler conditionally in Startup.ConfigureServices.

private readonly IWebHostEnvironment _env;
public Startup(IWebHostEnvironment env)
{
    _env = env;
}

public void ConfigureServices(IServiceCollection services)
{
  {...}

  //Allows auth to be bypassed
  if (_env.IsDevelopment())
    services.AddSingleton<IAuthorizationHandler, AllowAnonymous>();
}

Note AddAuthentication and AddAuthorization services are still registered and configured as per prod code (which is nice).

To allow our unit test to bypass auth, we added a new anonymous testbase with a startup class that added this line without any conditions. Nice and simple!

10
  • 1
    Nice :) .Net Core 3.0 IWebHostEnvironment doesnt have IsLocalDev() method but it does have IsDevelopment() -- I personally just use #if (DEBUG) directive though
    – Jimbo
    Jan 11, 2020 at 18:10
  • 1
    Yeah whoops, that is an extension method we have. eg: public static bool IsLocalDev(this IWebHostEnvironment environment) => environment.IsEnvironment("LocalDev"); Jan 13, 2020 at 0:30
  • 2
    This definitely helped with 3.1 upgrade. Not sure if this is a known issue?
    – Ambuj
    Feb 5, 2020 at 9:41
  • 1
    The IPolicyEvaluator solution by ozzy is a better, cleaner approach.
    – Matt M
    Mar 17, 2020 at 12:39
  • 2
    There's no need to use Linq and call .ToList() on context.PendingRequirements, because it is already IEnumerable, and can be iterated through by the foreach without conversion. Oct 13, 2020 at 12:32
59

You can bypass authorization in development environment by applying AllowAnonymousAttribute to your endpoints.

.NET 6 (ASP.NET Core 6) and newer, dotnet new webapi template
Use AllowAnonymous method in Program.cs to apply AllowAnonymousAttribute to all controllers:

if (app.Environment.IsDevelopment())
    app.MapControllers().AllowAnonymous();
else
    app.MapControllers();

.NET Core 3.0 - .NET 5 (ASP.NET Core 3.0-5), dotnet new webapi template
Use WithMetadata method in Startup.Configure() to apply AllowAnonymousAttribute to all controllers:

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    // preceding code omitted for brevity
    app.UseEndpoints(endpoints =>
    {
        if (env.IsDevelopment())
            endpoints.MapControllers().WithMetadata(new AllowAnonymousAttribute());
        else
            endpoints.MapControllers();
    });
}

Minimal API in .NET 6 (ASP.NET Core 6) and newer, dotnet new webapi -minimal template
Use AllowAnonymous method to apply AllowAnonymousAttribute to a minimal API endpoint:

var hiEndpoint = app
    .MapGet("/hi", () => "Hello!")
    .RequireAuthorization();

if (app.Environment.IsDevelopment())
    hiEndpoint.AllowAnonymous();

Details

endpoints and app from the examples above, both implement IEndpointRouteBuilder which has multiple Map extension methods like MapControllers() and MapGet(...) that return IEndpointConventionBuilder.

WithMetadata (available since .NET Core 3.0) and AllowAnonymous (available since .NET 5) are extensions for IEndpointConventionBuilder and can be called upon the results of those Map methods.

AllowAnonymousAttribute's description from the docs:

Specifies that the class or method that this attribute is applied to does not require authorization.

6
  • 2
    Thank you, this is what I was looking for: disable authentication for development environment for .NET Core 3.x and WebApi. All other solutions were not working for me.
    – robsosno
    Jul 16, 2020 at 12:00
  • 1
    Works with latest asp.net core as of 9/20 Sep 24, 2020 at 21:55
  • I like this solution more as it leverages the Dotnetcore pipeline Nov 10, 2021 at 16:48
  • I get an error, IApplicationBuilder does not have a definition for Environment () I injected it into configure, but it does not have MapControllers in asp core 6.0.1 I was not able to get past this Jan 26, 2022 at 3:03
  • 1
    @Transformer, this is correct. In the first ASP.NET Core 6 example, app has type WebApplication and not IApplicationBuilder. Please use dotnet new webapi .NET 6 CLI command to check the types.
    – roxton
    Jan 26, 2022 at 21:13
32

Another solution you may want to consider is using the IPolicyEvaluator. This means that you can keep all the existing security elements.

public class DisableAuthenticationPolicyEvaluator : IPolicyEvaluator
{
    public async Task<AuthenticateResult> AuthenticateAsync(AuthorizationPolicy policy, HttpContext context)
    {
        // Always pass authentication.
        var authenticationTicket = new AuthenticationTicket(new ClaimsPrincipal(), new AuthenticationProperties(), JwtBearerDefaults.AuthenticationScheme);
        return await Task.FromResult(AuthenticateResult.Success(authenticationTicket));
    }

    public async Task<PolicyAuthorizationResult> AuthorizeAsync(AuthorizationPolicy policy, AuthenticateResult authenticationResult, HttpContext context, object resource)
    {
        // Always pass authorization
        return await Task.FromResult(PolicyAuthorizationResult.Success());
    }
}

In the Startup.cs, ensure this appears at the top of the ConfigureServices method. Eg.

    public void ConfigureServices(IServiceCollection services)
    {
        if (env.IsDevelopment())
        {
            // Disable authentication and authorization.
            services.TryAddSingleton<IPolicyEvaluator, DisableAuthenticationPolicyEvaluator>();
        }
        ...

Rather than Startup.cs (and thanks to the comments below) if you are using Core 3.1 and you wish to use the WebApplicationFactory, you can do the following:

public class MyWebApplicationFactory : WebApplicationFactory<Program>
{
    protected override void ConfigureWebHost(IWebHostBuilder builder)
    {
        builder.ConfigureTestServices(services =>
        {
            // Disable Authentication.
            services.RemoveAll<IPolicyEvaluator>();
            services.AddSingleton<IPolicyEvaluator, DisableAuthenticationPolicyEvaluator>();
        });
    }
}
4
  • 3
    Best solution here and works with core 3.1. Simple, elegant, reusable.
    – Matt M
    Mar 17, 2020 at 12:38
  • 2
    I had another IPolicyEvaluator injected by the prod Startup (using JWT) so I needed to services.RemoveAll<IPolicyEvaluator>(); before AddSingleton .. not using TryAddSingleton is one less import, no need to try, and as I found, TryAddSingleton will indeed not add the singleton if there is already one registered
    – wbit
    May 2, 2020 at 4:50
  • 1
    Works with core 5 as well
    – gitsitgo
    Nov 25, 2021 at 20:32
  • Very good solution indeed!
    – ruzgarustu
    Jan 24, 2022 at 10:45
18

I've found sollution for this problem on illucIT Blog.

This code must work:

if (env.IsDevelopment()) {
   services.AddMvc(opts =>
   {
      opts.Filters.Add(new AllowAnonymousFilter());
   });
} else {
   services.AddMvc();
}
3
  • 7
    This does not work in latest .net core because IHostingEnvironment is not passed to ConfigureServices
    – Dagrooms
    Feb 21, 2019 at 0:33
  • 4
    @Dagrooms you can inject IHostingEnvironment to Startup constructor and use it in ConfigureServices ;) Jun 14, 2019 at 14:12
  • 3
    Yep, figured that out after scanning through docs, it's surprisingly hard to find good info
    – Dagrooms
    Jun 14, 2019 at 14:20
8

It's tricky to give a detailed answer without more details on your end, but I have previously achieved this by conditionally registering:

  • the external authentication middleware
  • the global policy that requires an authenticated request

it looked something like:

public class Startup
{
    public Startup(IHostingEnvironment env)
    {
        Environment = env;
    }

    public IHostingEnvironment Environment { get; }

    public void ConfigureServices(IServiceCollection services)
    {
        services.AddMvc(x =>
        {
            if (!Environment.IsDevelopment())
            {
                var authenticatedUserPolicy = new AuthorizationPolicyBuilder()
                    .RequireAuthenticatedUser()
                    .Build();

                x.Filters.Add(new AuthorizeFilter(authenticatedUserPolicy));
            }
        });
    }

    public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
    {
        app.UseStaticFiles();

        if (!Environment.IsDevelopment())
        {
            // Register external authentication middleware
        }

        app.UseMvc(routes =>
        {
            routes.MapRoute(
                name: "default",
                template: "{controller=Home}/{action=Index}/{id?}");
        });
    }
}

In my case, the authorization filter was applied globally, so every single action of the MVC app required an authenticated user.

If you have different requirements - fine-grained [Authorize] attributes on some actions - then you could probably achieve the same result by changing how the associated authorization policies are built. They could basically contain no requirements at all.

AuthorizationPolicy yourCustomPolicy = null;
if (Environment.IsDevelopment())
{
    yourCustomPolicy = new AuthorizationPolicyBuilder().Build();
}
else
{
    yourCustomPolicy = new AuthorizationPolicyBuilder()
        // chaining appropriate methods to suit your needs
        .Build();
}
3
  • It looks exactly what I'm searching for. I'll test it
    – fra
    Jan 12, 2017 at 19:40
  • 1
    This solution may work with ASP.NET Core 1.x, but in ASP.NET Core 2.0, they have change the authentication pipeline. What works for me in 2.0 is this answer stackoverflow.com/a/40156927/1118893
    – Shabbir
    Nov 2, 2017 at 9:07
  • Could you let me know what you think doesn't work? I'm using this technique in ASP.NET Core 2.0 with success. Nov 2, 2017 at 10:43
5

In ASP.NET Core 6, we managed to disable the authorization without changing any other part from the productive code, just the following logic in Program.cs:

if (!builder.Environment.IsDevelopment())
{
    app.MapControllers();
}
else
{
    app.MapControllers().AllowAnonymous();
}
1

This is to clarify @Kirill Lutsenko's answer about the method he found on the IllucIT blog post (note that in my case this is for .NET Core 2.0. I see other answers saying the AllowAnonymousFilter method won't work in .NET Core 3.1):

The Startup class has an overloaded constructor. One of the overloads takes an IHostingEnvironment parameter. You need to use this version of the constructor.

In the Startup class create a property of type IHostingEnvironment. Call it, say, Environment. Then set that property in the constructor.

Then, in the ConfigureServices method, you can use Environment.IsDevelopment().

public class Startup
{        
    public Startup(IHostingEnvironment environment)
    {
        Environment = environment;
    }
    
    public IHostingEnvironment Environment { get; }

    public IServiceProvider ConfigureServices(IServiceCollection services)
    {
        //...

        services.AddMvc(options =>
        {
            // This uses the Environment property populated in the constructor.
            if (Environment.IsDevelopment())
            {
                options.Filters.Add(new AllowAnonymousFilter());
            }
            
            // Set other options here.  For example:
            options.ModelBinderProviders.Insert(0, new UTCDateTimeModelBinderProvider());
            //...
        });
        
        //...
    }
}

As a side note, in real life we use a different overload of the constructor, which takes both an IConfiguration object and an IHostingEnvironment object as parameters. That allows us to configure services based on an appsettings.json configuration file.

For example:

public class Startup
{        
    public Startup(IConfiguration configuration, IHostingEnvironment environment)
    {
        Configuration = configuration;
        Environment = environment;
    }
    
    public IConfiguration Configuration { get; }
    public IHostingEnvironment Environment { get; }

    public IServiceProvider ConfigureServices(IServiceCollection services)
    {
        //...

        // Data access via Entity Framework
        services.AddDbContext<ContainersDbContext>(options =>
        {
            options.UseNpgsql(Configuration.GetConnectionString("OrdersDatabase"));
        });
        
        //...
    }
}
0

As this thread comes up if you're looking up the error "System.NotSupportedException: Negotiate authentication requires a server that supports IConnectionItemsFeature like Kestrel." with .Net 7, the only way I was able to get around this issue with an MVC .Net Core project was to change my Program.cs.

Basically, removing the Authentication from the Services.

Note: You will have to manage your web apps launchSettings.json file and it's ASPNETCORE_ENVIRONMENT values. Which will be a part of your deployment.

Original Program.cs code:

builder.Services.AddAuthentication(NegotiateDefaults.AuthenticationScheme).AddNegotiate();

builder.Services.AddAuthorization(options =>
{
    options.FallbackPolicy = options.DefaultPolicy;
});

New Code:

if (!builder.Environment.IsDevelopment())
{
    builder.Services.AddAuthentication(NegotiateDefaults.AuthenticationScheme).AddNegotiate();

    builder.Services.AddAuthorization(options =>
    {
        options.FallbackPolicy = options.DefaultPolicy;
    });
}

Not the answer you're looking for? Browse other questions tagged or ask your own question.