MVC [Authorize]属性可用于除主页以外的所有页面

Question

I'm using cookie authentication in a .Net Core 2.1 web app and I can't seem to get the authorize attribute to work on the default home page (webapp url). The attribute is working on all other pages.

When I go to https://appurl/home it redirects to login, but navigating to https://appurl doesn't require auth at all. Here is my startup routing:

app.UseMvc(routes =>
        {
            routes.MapRoute(
                name: "Home",
                template: "{controller=Home}/{action=Index}/{id?}");
        });

Here is my home controller:

[Authorize]
public class HomeController : Controller
{
    public IActionResult Index()
    {
        return View();
    }

    [ResponseCache(Duration = 0, Location = ResponseCacheLocation.None, NoStore = true)]
    public IActionResult Error()
    {
        return View(new ErrorViewModel { RequestId = Activity.Current?.Id ?? HttpContext.TraceIdentifier });
    }
}

All other controllers marked with [Authorize] like this redirect to login as expected, I just don't know how to specify authorization on the default app url.

Any help would be greatly appreciated.

UPDATE: I suppose I've solved my issue by basically requiring auth by default and allowing anon access to just my login razor page (I'm using both mvc and razor pages). I'm still curious if it can be done another way, but here is my startup.cs:

 public class Startup
{
    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    public IConfiguration Configuration { get; }

    // This method gets called by the runtime. Use this method to add services to the container.
    public void ConfigureServices(IServiceCollection services)
    {
        /*
        services.Configure<CookiePolicyOptions>(options =>
        {
            // This lambda determines whether user consent for non-essential cookies is needed for a given request.
            options.CheckConsentNeeded = context => true;
            options.MinimumSameSitePolicy = SameSiteMode.None;
        });
        */

        services.AddMvc(options =>
            {
                var policy = new AuthorizationPolicyBuilder()
                    .RequireAuthenticatedUser()
                    .Build();
                options.Filters.Add(new AuthorizeFilter(policy));
            })
            .AddRazorPagesOptions(options =>
            {
                options.Conventions.AllowAnonymousToPage("/Account/Login");
            })
            .SetCompatibilityVersion(CompatibilityVersion.Version_2_1);

        services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
            .AddCookie(options =>
            {
                options.LoginPath = "/Account/Login";
                options.LogoutPath = "/Account/Logout";
            });

        // Add DB contexts here.
        services.Configure<Database.DatabaseConfig>(Configuration.GetSection("ConnectionStrings"));

        services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>();
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/Home/Error");
            app.UseHsts();
        }

        app.UseHttpsRedirection();
        app.UseStaticFiles();
        app.UseCookiePolicy();
        app.UseAuthentication();

        app.UseMvc(routes =>
        {
            routes.MapRoute(
                name: "default",
                template: "{controller=Home}/{action=Index}/{id?}");
        });
    }
}

Answer 1

It seems you forgot to add services.AddAuthorization (); below services.AddAuthentication (...);

If you do that, probably you will not need this:

services.AddMvc(options =>
{
    var policy = new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .Build();
    options.Filters.Add(new AuthorizeFilter(policy));
})
.AddRazorPagesOptions(options =>
{
    options.Conventions.AllowAnonymousToPage("/Account/Login");
})
.SetCompatibilityVersion(CompatibilityVersion.Version_2_1);

You can change for this:

services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);