Question

I have seen example code that looks like this, which seems perfectly reasonable:

[Authorize(Roles = "Admin, User")] 
public class SomeController : Controller 

But I have also seen several examples that look like this:

[Authorize(Users = "Charles, Linus")] 
public class SomeController : Controller 

Why would I ever want to do this? I can’t imagine any scenario where I would want to build a system that knows its user names in advance.

Answer 1

There are a few legitimate uses of this, and here’s one example: If you’re building a really simple site, that simply has an admin account and an unauthenticated account, you could do

[Authorize(Users = "Admin")] 

This saves you the trouble of bothering to construct roles just for a single user. Think UNIX style, where the root account (uid 0) is special rather than a particular group.

Another example is simply a throw-away application, where you’re testing something. There’s no reason to bother with roles if you just want to test your authentication page or something like that.

One more reason: testing. You could build a unit test just for your authentication without wanting to unit test your role based framework. (Keep in mind, not everyone is using the default membership provider, and some membership providers are pretty sophisticated.) By creating a hard coded authentication for a test user, you can bypass the roles framework.