Apply [Authorize] attribute implicitly to all Web API controllers

Question

My application is setup where all requests except login must be 'authorized' using the authorization attribute in Web API. E.g.

 [Authorize]  [HttpGet, Route("api/account/profile")]  public ApplicationUser Profile()  {        return userModel;  } 

and only the login needs to not authorize since thats where you get the token ;)

[AllowAnonymous] [HttpPost, Route("api/account/login")] public async Task<IHttpActionResult> Login(LoginViewModel model) {    .... } 

instead of having to add the [Authorize] attribute to ALL my routes, is there a way to set it globally?

Answer 1

You have two options

1. Controller level by decorating your controller with authorize attribute.

   [Authorize] [RoutePrefix("api/account")] public class AccountController : ApiController { 

2. You can also set it global level to all routes, in Register method of WebApiConfig.cs file

    config.Filters.Add(new AuthorizeAttribute()); 

Answer 2

You can set the AuthorizeAttribute to the WebApiConfig file like below:

public static void Register(HttpConfiguration config) {   config.Routes.MapHttpRoute(     name: "DefaultApi",     routeTemplate: "api/{controller}/{id}",     defaults: new { id = RouteParameter.Optional }   );   config.Filters.Add(new AuthorizeAttribute()); } 

Now all methods from your Web Api controllers will need authorization. If you want to remove this authorization requirement for a method, you need to add the attribute [AllowAnonymous] like in the Login action method.