Question

So far I’ve seen the main advice for applying authorization rules consists of adding various attributes to actions. Which is fine if the majority of your actions don’t require authorisation.

However my application entirely exists behind a login form, so for me it makes sense to have all actions require authorisation by default.

Is there a way to do this without having to annotate every method?

Answer 1

1. You can dictate the login via the web.config.
2. You can derive all your controllers from a common base controller which either has an attribute over it, or override the OnAuthorization method.
3. Implement the Application_AuthenticateRequest in the Global.asax.