Middleware for Authencation

Question

I have created a ASP.NET MVC core application. I just finished creating and logging in a user. Now I'm trying to figure out
1. how to have the user login info saved
2. how to require a user to be logged in to visit the rest of the the site.
For saving the user log info. I was going to use either Identity or Asp.Net.Session, but seeing has I cant find anything that shows how to require the user to be logged in to visit routes, I’m unsure which option would work best.
Could someone explain to me how to require authentication before accessing a route, and which of the saving login info works best with that method?

Current Login Example

    public ActionResult Login(LoginModel model){
        if (ModelState.IsValid){
            SqlConnect test = new SqlConnect("Data Source=/home/andrew/database.db","Accounts"); 
            var check = test.count(model.UserName,model.Password); 
            if(check){
                // Found in database 
                return RedirectToAction("Index","Home");
            }
        }

        // If we got this far, something failed, redisplay form
        return RedirectToAction("Error","Home");
    }

Answer 1

You shouldn't secure routes. When using placeholders (such as in the default route), it is possible that more than one route can reach an action method. These alternate paths are sure to be difficult (nearly impossible) to keep secure as your application changes over time.

So the best option is to secure the resources by preventing them from being served. Note that this is also the way security works in ASP.NET, so both ASP.NET and MVC hook into the same mechanism (IPrincipal and IIdentity) to control both authentication and authorization. ASP.NET Identity and older security frameworks from Microsoft all use this extension point to plug into MVC and ASP.NET.

In MVC, it is the AuthorizeAttribute that uses these interfaces to secure action methods. AuthorizeAttribute can be used in several ways:

On Action Methods

public class MyController
{
    [Authorize(Roles = "Admin,SuperUser")]
    public ActionResult Index()
    {
        return View();
    {
}

On Controllers

[Authorize(Roles = "Admin,SuperUser")]
public class MyController
{
    [AllowAnonymous] // All users have access
    public ActionResult Index()
    {
        return View();
    {

    // Only authenticated users in Admin or SuperUser
    // role have access
    public ActionResult Contact()
    {
        return View();
    {

    // Only authenticated users in Admin or SuperUser
    // role have access
    public ActionResult About()
    {
        return View();
    {
}

Globally

public class FilterConfig
{
    public static void RegisterGlobalFilters(GlobalFilterCollection filters)
    {
        filters.Add(new AuthorizeAttribute());
        filters.Add(new HandleErrorAttribute());
    }
}

This means that only authenticated users can access any action method in your application. You can also use roles here like filters.Add(new AuthorizeAttribute() { Roles = "Foo,Bar" });. And you can allow specific controllers/actions access to unauthenticated users with the AllowAnonymousAttribute.

You can also subclass AuthorizeAttribute if you have more complex business logic than just Users and Roles.