Require authentication

In many applications, you want to prevent the user from accessing certain routes or sections unless they are signed in. You can require authentication across the entire app or just require it for particular routes or controllers. Any route that doesn't specifically require authentication is accessible without signing in (also called anonymous access).

Require authentication for a specific route

If you want the user to only have access to a route if they are signed in, require authentication for just those routes.

• ASP.NET
• ASP.NET Core 2.x
• ASP.NET Core 3.x
• Go
• Node Express
• PHP
• Spring Boot

Use the [Authorize] attribute on controllers or actions to require a signed-in user:

[Authorize]
public IActionResult Protected()
{
    // Only for signed-in users!
    return View();
}

Require authentication for everything

For some applications, you may want to require the user to be authenticated for all routes.

• ASP.NET
• ASP.NET Core 2.x
• ASP.NET Core 3.x
• Go
• Node Express
• PHP
• Spring Boot

To require authentication for all actions, you can create an authorization policy to be used everywhere:

public void ConfigureServices(IServiceCollection services)
{
    services.AddMvc(o =>
    {
        var policy = new AuthorizationPolicyBuilder()
            .RequireAuthenticatedUser()
            .Build();
        o.Filters.Add(new AuthorizeFilter(policy));
    });
}

Or, you could create a BaseProtectedController and make all of your controllers inherit from it:

[Authorize]
public abstract class BaseProtectedController : Controller
{
    //...
}

With all routes protected, you can make specific routes accessible to unauthenticated users with the [AllowAnonymous] attribute.

Next: Get info about the user