Globally Require Authenticated Users By Default Using Fallback Policies in ASP.NET Core

Nice article

Scott Sauber

tldr;

You can use Fallback Policies in ASP.NET Core 3.0+ to require an Authenticated User by default. Conceptually, you can think of this as adding an [Authorize] attribute by default to every single Controller and Razor Page ONLY WHEN no other attribute is specified on a Controller or Razor Page (like [AllowAnonymous] or [Authorize(PolicyName="PolicyName")]).  See lines 9-11 below.

A Quick Lap Around the [Authorize] and [AllowAnonymous] Attributes

In ASP.NET Core (and even previously in ASP.NET), we’ve had the ability to add a [Authorize] attribute to a resource (such as a Controller or Razor Page) in order to tell ASP.NET Core not to let a user access that resource unless they are authenticated.

The [Authorize] attribute can also take a PolicyName parameter that tells it what Authorization Policy to execute.  The Policy below says only Admins can access this page.

You can follow this link to learn more how to…

View original post 775 more words

Requiring MFA for Admin Pages in an ASP.NET Core Identity application

Nice article from Damien.

Software Engineering

This article shows how MFA could be forced on users to access sensitive pages within an ASP.NET Core Identity application. This could be useful for applications where different levels of access exist for the different identities. For example, users might be able to view the profile data using a password login, but an administrator would be required to use MFA to access the admin pages.

Code: https://github.com/damienbod/AspNetCoreHybridFlowWithApi

Blogs in this series

Extending the Login with a MFA claim

The application is setup using ASP.NET Core with Identity and Razor Pages. In this demo, the SQL Server was replaced with SQLite, and the nuget packages were updated. The AddIdentity method is used instead of AddDefaultIdentity one, so…

View original post 344 more words

Interfaces In C# 8.0

As we all know C# 8.0 was released a few days back which has come up with the many exciting features along with this release of C# there are significant amount of changes in interfaces have also been happened so with this article let’s try to explore the new feature and try to learn how … Continue reading Interfaces In C# 8.0

.Net 5.0 : The future of .Net

In my previous post I added links to get the archived presentations and sessions for .Net Conf 2019 which you can find here. In this quick post we will see what is long term .Net release schedule and what is the near future of .Net. .Net Core 3.0 .Net Core 3.0 is current major release … Continue reading .Net 5.0 : The future of .Net

Archive for .Net Conf 2019 presentations and sessions

You might have followed .Net Conf which is one of the biggest conferences for Microsoft technology stacks. I wrote a small post for .Net Conf before few days which you can find here. Even though you might have followed some sessions from .Net Conf, it is very tough to catch all the sessions as they … Continue reading Archive for .Net Conf 2019 presentations and sessions

Adding external authentication with a Microsoft account

Very nice article: Adding external authentication with a Microsoft account

Sam Learns Azure

Today, we are going to add external authentication to our website, enabling us to restrict some features to logged in users. As we don’t want to manage users and passwords ourselves, we will utilize other authentication services, such as Microsoft Live/Account, Google, Twitter, and Facebook. Today, we will setup the infrastructure and connect to the Microsoft account, and then next week, show how to connect to Google, Twitter and Facebook too.

Upgrading to .Net Core 2.2

Before we start to add the authentication code, we are quickly going to upgrade to .Net Core 2.2, from 2.1. This was surprisingly easy for us – perhaps because of our automated testing. We didn’t have to update any code, except for the compatibility line in startup.cs in our web service and web site. This also gave us an opportunity to upgrade all of the NuGet packages to their latest versions. The automated tests…

View original post 1,132 more words

HDC 2019 – HTTP Security Headers

A nice document on HTTP Security headers by Scott Sauber.

Scott Sauber

Note: Slides do not tell the whole story of the talk, so take the stand alone slides with a grain of salt. Things may be taken out of context.

Slides: PPTX or PDF

View original post