MVC 3 anoNynmous and Windows authentication combined

Question

I have a web application which is secured down by Windows authentication. However, I have one controller which needs to be available globally to anyone, so they do not need a Windows account on the server to be granted access.

I have got this to work by enabling both Windows authentication, and Anonymous Authentication in IIS. My controllers now look like this:

[Authorize]
public class MyController : Controller
{
    public Index()
    {
    }

    public DoStuff()
    {
    }

    etc...
}

My anonymous controller is the same, except I have removed the [Authorise] attribute from the start of it.

Am I right in saying that this instructs the web application to only allow those users with a Windows account to use the majority of controllers, except for the controller which I want to allow anonymous access to?

It seems to work just fine, but I wanted to ensure I have not left a gaping security hole open by doing this?

Are there any issues with enabling both methods of authentication, and setting the application up in this way?

Answer 1

First of all, the way you are doing it, there is no gaping hole in the security of your application and it will behave the way you are anticipating. But there is a better way ...

The problem with Authorize attribute is that it's easy to forget to the new controller you add to your application and if you don't add it, your controller is open to the public.

If you were using MVC 4, you could add the Authorize attribute as a global filter and then use AllowAnonymous attribute on your anonymous controller(s) because Authorize attribute respects AllowAnonymous attribute by Default. MVC 3, on the other hand, doesn't ship with AllowAnonymous attribute. T

The way around is to create the AllowAnonymous attribute yourself in your project like so:

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false, Inherited = true)]
public sealed class AllowAnonymousAttribute : Attribute { }

Now, you can subclass from the built in Authorize attribute to customize that and look for Anonymous attribute applied to your controller. If you find the attribute, you can skip the authorization. Here is an example implementation:

public sealed class AuthorizeWithAnonymousSupportAttribute : AuthorizeAttribute
    {
        public override void OnAuthorization(AuthorizationContext filterContext)
        {
            bool skipAuthorization = filterContext.ActionDescriptor.IsDefined(typeof(AllowAnonymousAttribute), true)
            || filterContext.ActionDescriptor.ControllerDescriptor.IsDefined(typeof(AllowAnonymousAttribute), true);
            if (!skipAuthorization)
            {
                base.OnAuthorization(filterContext);
            }
        }
    }

You will have to add this attribute to the global filters of your site. In your Global.asax:

public static void RegisterGlobalFilters(GlobalFilterCollection filters) {
    filters.Add(new AuthorizeWithAnonymousSupportAttribute ());
    filters.Add(new HandleErrorAttribute());
}

Now, the last step. You can simply add the AllowAnonymous attribute to any controller you want to be anonymous:

[AllowAnonymous]
public class MyController : Controller
{
    public Index()
    {
    }

    public DoStuff()
    {
    }

    etc...
}

The benefit of doing all of the above is that you don't have to worry about putting Authorize attribute to the controllers you add to your application. Instead, you will have to explicitly tell the application which controllers are open to the public.

Thanks and hope this helps.