Authentication And Authorization In ASP.NET Core MVC Using Cookie

services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
        .AddCookie();

app.UseAuthentication();

using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
namespace CookieDemo
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }
        public IConfiguration Configuration { get; }
        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            services.Configure<CookiePolicyOptions>(options =>
            {
                // This lambda determines whether user consent for non-essential cookies is needed for a given request.
                options.CheckConsentNeeded = context => true;
                options.MinimumSameSitePolicy = SameSiteMode.None;
            });
         services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie();
            services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
        }
        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            else
            {
                app.UseExceptionHandler("/Home/Error");
            }
            app.UseStaticFiles();
            app.UseCookiePolicy();
            app.UseAuthentication();
            app.UseMvc(routes =>
            {
                routes.MapRoute(
                    name: "default",
                    template: "{controller=Home}/{action=Index}/{id?}");
            });
        }
    }
}

using System;
using System.Collections.Generic;
using System.Linq;
using System.Security.Claims;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Mvc;
namespace CookieDemo.Controllers
{
    public class AccountController : Controller
    {
        public IActionResult Login()
        {
            return View();
        }
        [HttpPost]
        public IActionResult Login(string userName, string password)
        {
            if (!string.IsNullOrEmpty(userName) && string.IsNullOrEmpty(password))
            {
                return RedirectToAction("Login");
            }
            // Check the user name and password
            // Here can be implemented checking logic from the database
            if (userName == "Admin" && password == "password")
            {
                // Create the identity for the user
                var identity = new ClaimsIdentity(new[]
                {
                    new Claim(ClaimTypes.Name, userName)
                }, CookieAuthenticationDefaults.AuthenticationScheme);
                var principal = new ClaimsPrincipal(identity);
                var login = HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, principal);

                return RedirectToAction("Index", "Home");
            }
            return View();
        }
    }
}

@{
    ViewData["Title"] = "Login";
}
<div class="container">
    <div class="row">
        <div class="col-md-3">
            <h2><strong>Login Page</strong></h2><br />
            <form asp-action="login" method="post">
                <div class="form-group">
                    <label>User Name</label>
                    <input type="text" class="form-control" id="userName" name="userName" placeholder="Enter user name">
                </div>
                <div class="form-group">
                    <label>Password</label>
                    <input type="password" class="form-control" name="password" id="password" placeholder="Password">
                </div>
                <div class="form-check">
                    <button class="btn btn-info" type="reset">Reset</button>
                    <button type="submit" class="btn btn-primary">Submit</button>
                </div>
            </form>
        </div>
    </div>
</div>

So far we have implemented the Cookie-based Authentication functionality in Asp.Net Core MVC project. But what about Authorization. Authorization means, providing access to the authenticated user to access a resource based on role.

So, let's first understand how we can implement the Authorization in Asp.Net Core MVC. For now, if you will try to access the HOME page without sign in, you can access it. So, let’s prevent the anonymous user from accessing the HOME page directly, if someone wants to access the HOME page then they should have to go through the Authentication process and then they will be able to access it.

So, to accomplish this, let’s open the Home Controller and put the [Authorize] attribute just above to controller. You can place it at the action level but here we would like to block the whole home controller functionality and if we want to access it, just go and log in. So, just do something like below.

using CookieDemo.Models;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using System.Diagnostics;
namespace CookieDemo.Controllers
{
    [Authorize]
    public class HomeController : Controller
    {
        public IActionResult Index()
        {
            return View();
        }
        public IActionResult About()
        {
            ViewData["Message"] = "Your application description page.";

            return View();
        }
        public IActionResult Contact()
        {
            ViewData["Message"] = "Your contact page.";

            return View();
        }
        public IActionResult Privacy()
        {
            return View();
        }
        [ResponseCache(Duration = 0, Location = ResponseCacheLocation.None, NoStore = true)]
        public IActionResult Error()
        {
            return View(new ErrorViewModel { RequestId = Activity.Current?.Id ?? HttpContext.TraceIdentifier });
        }
    }
}

Note

Be sure you have cleared all cookies that have been created based on your previous login. If you do not do this, you will be accessing the HOME page, it is because an authenticated user cookie is available in the browser memory.

So, let's check how it works. Run the application and try to access the Home page. You will see here that your application automatically redirects to the Login page. Now let's try to provide the user information as username = "Admin" and password =" password". Once you will pass the correct credentials and log then you will be redirected to HOME page. So, let's add the feature that shows the logged-in username along with a logout button. If you click on the log-out button, your cookie value will be deleted and you will be redirected to the login page.

So, let's open the Account Controller and add the following logout action method.

[HttpPost]
public IActionResult Logout()
{
    var login = HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
    return RedirectToAction("Login");
}

And now open the Index.cshtml file from the Home folder inside the Views and modify the code as follows. Here, first of all, we are trying to show the Logged In username using @User.Identity.Name and apart from this adding a link for out.

@{
    ViewData["Title"] = "Home Page";
}
<div class="container">
    <div class="row">
        <div class="col-md-12">
            <h2><strong>Home Page</strong></h2><br /><br />
            Hello @User.Identity.Name
            <a asp-action="logout" asp-controller="account">
                Logout
            </a>
            <br /><br />
            <h4>Welcome to Asp.Net Core Authentication and Authorization Demo!!</h4>
        </div>
    </div>
</div>

So far, we are able to understand how to implement Authentication in Asp.Net Core MVC and how to implement Authorization and give access to validate the users. Now, let's understand how to work with multiple roles. Here we are doing everything manually with some static value, but you can change the logic and connect to the database for validating the user. So, just modify the Login method as follows where we are providing two different kinds of roles; one is Admin role and another is User role. Based on these roles, we will provide access to some of the pages.

[HttpPost]
public IActionResult Login(string userName, string password)
{
    if (!string.IsNullOrEmpty(userName) && string.IsNullOrEmpty(password))
    {
        return RedirectToAction("Login");
    }
    // Check the user name and password
    // Here can be implemented checking logic from the database
    ClaimsIdentity identity = null;
    bool isAuthenticated = false;
    if (userName == "Admin" && password == "password")
    {
        // Create the identity for the user
        identity = new ClaimsIdentity(new[]
        {
            new Claim(ClaimTypes.Name, userName),
            new Claim(ClaimTypes.Role, "Admin")
        }, CookieAuthenticationDefaults.AuthenticationScheme);
        isAuthenticated = true;
    }
    if (userName == "Mukesh" && password == "password")
    {
        // Create the identity for the user
        identity = new ClaimsIdentity(new[]
        {
            new Claim(ClaimTypes.Name, userName),
            new Claim(ClaimTypes.Role, "User")
        }, CookieAuthenticationDefaults.AuthenticationScheme);

        isAuthenticated = true;
    }
    if (isAuthenticated)
    {
        var principal = new ClaimsPrincipal(identity);
        var login = HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, principal);
        return RedirectToAction("Index", "Home");
    }
    return View();
}

Now let's move to HomeController remove the [Authorize] attribute from the class level and put it in the action level as follows. Here we have two different action methods which point to two different views. One is pointing to the Index view and another one is pointing to the Setting page. The index page can be accessible to both types of roles, either it is Admin or User but the Setting page can be accessed only by the Admin role.

public class HomeController : Controller
{
    [Authorize(Roles = "Admin, User")]
    public IActionResult Index()
    {
        return View();
    }
    [Authorize(Roles = "Admin")]
    public IActionResult Setting()
    {
        return View();
    }
}

Now modify the Index.cshtml file and add one thing as Role, just modify the code as follows.

@{
    ViewData["Title"] = "Setting Page";
}  
<div class="container">
    <div class="row">
        <div class="col-md-12">
            <h2><strong>Setting Page </strong></h2><br /><br />
            Hello @User.Identity.Name !, Role @User.FindFirst(claim => claim.Type == System.Security.Claims.ClaimTypes.Role)?.Value
            <a asp-action="logout" asp-controller="account">
                Logout
            </a>
            <br />
            <br />
            <h4>Admin role user can only access this page!!</h4>
        </div>
    </div>
</div>

Now, we have added everything and it's time to run the application. So, just press F5 and it will run your application. First, go to the "Login" page and log in with the "User" role.

Once you log in as a User role, definitely you will be redirected to the home page because the home page is accessible to both types the roles.

Now, let's try to access the settings page, here you will get some Access Denied error. It is because the "User" role member does not allow you to access the settings page. By default, you will get the following error as per the browser. But you can customize your error and page as well. It totally depends on you.

Now, let's log out of the application for the "User" role and try to log in for the Admin role. As follows, you can see, we are able to access the home page.

But let's try to access the settings page for the "Admin" role and yes, you will access the settings page.

Lastly, let me show how you can see the cookie information. For this demo, I am using the Microsoft Edge browser, you can use any other as per your choice. But cookie information is saved almost in the same place for every browser. So, just go to the Network tab and then the Cookie tab. Here you can see all the listed Cookies.

Conclusion

So, today we have learned what authentication and authorization are and how to implement the Cookie Based Authentication and Authorization in Asp.Net Core MVC.

I hope this post will help you. Please leave your feedback using the comments which helps me to improve myself for the next post. If you have any doubts please ask your doubts or query in the comment section and If you like this post, please share it with your friends. Thanks.