AuthorizeAttribute Class

Many Web applications require users to log in before the users are granted access to restricted content. In some applications, even users who are logged in might have restrictions on what content they can view or what fields they can edit.

To restrict access to an ASP.NET MVC view, you restrict access to the action method that renders the view. To accomplish this, the MVC framework provides the AuthorizeAttribute class.

For more information about using attributes, see Extending Metadata Using Attributes.

This topic contains the following sections:

• Using AuthorizeAttribute

• Deriving from AuthorizeAttribute

Using AuthorizeAttribute

Deriving from AuthorizeAttribute

The following example shows several ways to use AuthorizeAttribute. The HomeController class has three action methods that are marked with the Authorize attribute, and two that are not marked. On the AuthenticatedUsers method, the attribute limits access to users who are logged in. On the AdministratorsOnly method, the attribute limits access to users who have been assigned to either the Admin role or the Super User role. On the SpecificUserOnly method, the attribute limits access to the users whose names are Betty or Johnny. The Index and About methods can be accessed by anyone, even anonymous users.

[HandleError]
 public class HomeController : Controller
 {
     public ActionResult Index()
     {
         ViewData["Message"] = "Welcome to ASP.NET MVC!";

         return View();
     }

     public ActionResult About()
     {
         return View();
     }

     [Authorize]
     public ActionResult AuthenticatedUsers()
     {
         return View();
     }

     [Authorize(Roles = "Admin, Super User")]
     public ActionResult AdministratorsOnly()
     {
         return View();
     }

     [Authorize(Users = "Betty, Johnny")]
     public ActionResult SpecificUserOnly()
     {
         return View();
     }
 }

Reference

Other Resources