Skip to content

Require authenticated user

This operation adds a global MVC authorization filter that requires every action in the application to have an authenticated user, unless the action is separately marked [AllowAnonymous].

Field Value
Operation ID OP-06
Trigger Application startup code calls RequireAuthenticatedUser() on IServiceCollection.
Inputs None (parameterless).
Outputs A global AuthorizeFilter is added to MvcOptions.Filters.
Primary components IServiceCollectionExtensions.RequireAuthenticatedUser
Entry point src/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/IServiceCollectionExtensions.cs (L116–128)

Steps

  1. AddMvc(o => o.Filters.Add(new AuthorizeFilter(new AuthorizationPolicyBuilder().RequireAuthenticatedUser().Build()))) (BR-SE-09)
  2. If a request reaches an action without an authenticated user: the ASP.NET Core authorization middleware issues a challenge/forbid response (framework behavior).

Process flow

This diagram shows the one-time filter-registration work performed when RequireAuthenticatedUser() is called during service configuration, not the per-request authorization check the resulting filter performs later.

flowchart TD
    Start([RequireAuthenticatedUser called]) --> S1[Build RequireAuthenticatedUser policy]
    S1 --> S2[Add global AuthorizeFilter to MvcOptions]
    S2 --> EndOk([All MVC actions require authentication by default])

Failure and edge-case behavior

  • A request without a valid authenticated principal is challenged or forbidden by the ASP.NET Core authorization pipeline, per the registered global filter.

Sources

  • src/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/IServiceCollectionExtensions.cs