o_19mgorv9t13a3ko71fev19l81mqa.pdf

Using Authentication Filters
Authentication filters are new in MVC version 5 and provide the means to provide fine-grain control over how users are
authenticated for controllers and actions in an application.
Authentication filters have a relatively complex lifecycle. They are run before any other filter, which lets you define an
authentication policy that will be applied before any other type of filter is used. Authentication filters can also be combined with
authorization filters to provide authentication challenges for requests that don’t comply to the authorization policy. Authentication
filters are also run after an action method has been executed but before the ActionResult is processed. I explain how all of
this works and provide some examples along the way.
Understanding the IAuthenticationFilter Interface
Authentication filters implement the IAuthenticationFilter interface, which is shown in Listing 18-13.
Listing 18-13. The IAuthenticationFilter Interface
namespace System.Web.Mvc.Filters {
public interface IAuthenticationFilter {
void OnAuthentication(AuthenticationContext context);
void OnAuthenticationChallenge(AuthenticationChallengeContext
context);
}
}
The OnAuthenticationChallenge method is called by the MVC Framework whenever a request has failed the
authentication or authorization policies for an action method. The OnAuthenticationChallenge method is passed an
AuthenticationChallengeContext object, which is derived from the ControllerContext class I
described in Chapter 17 and which defines the additional properties shown in Table 18-4.
Table 18-4. The properties defined by the AuthenticationChallengeContext class
Name
Description
ActionDescriptor Returns an
ActionDescriptor that describes the action method to which the filter has been applied
Result Sets an ActionResult that expresses the result of the authentication challenge
The most important property is Result, because it allows the authentication filter to pass an ActionResult to the
MVC Framework, a process known as short-circuiting that I will describe shortly. The best way of explaining how an
authentication filter works is through an example. To my mind, the most interesting aspect of authentication filters is that they
allow a single controller to define action methods that are authenticated in different ways, so my first step is to add a new
controller that simulates Google logins. In Listing 18-14, you can see the definition of the
GoogleAccountController.
Listing 18-14. The Contents of the GoogleAccountController.cs File
using System.Web.Mvc;
using System.Web.Security;
namespace Filters.Controllers {
public class GoogleAccountController : Controller {
public ActionResult Login() {
return View();
}
469