I have an existing ASP.NET Core MVC application that I want to add a new API method in a controller. I want to touch the authentication/authorization code as little as possible, so I don't want to write a new authentication middleware for this one API.
The method is supposed to return some type of data if the user is anonoymous/unknown. And it should return more specific and potentially personal information if the user is signed in and has a valid user.
Is it safe to skip the [Authorize] attribute, and check only check the HttpContext.User (https://learn.microsoft.com/en-us/dotnet/api/system.web.httpcontext.user?view=netframework-4.8) property for the username?
Can I assume that the signature has been verified by the OpenID Connect middleware?
// No Authorize attribute
public IActionResult MyApi()
{
string userName = System.Security.Claims.Claim idClaim = this.HttpContext.User?.Claims?.FirstOrDefault(a => a.Type == "sub")?.Value;
// Can I assume that the User object only is non-null if the OAuth signature is actually verified?
// Or is fake-cookies possible?
}
HttpContext.User.Identity.IsAuthenticated
. That mean everybody! But if you need different kinds of authenticated users receive different kind of responses then I think you should use Policies.