如何在ASP.net Core 2.2中为我的CRUD Web应用程序实现基本安全性？

Question

I have followed a wonderful tutorial by Microsoft on creating a MVC web app using Core 2.2 ( https://docs.microsoft.com/en-us/aspnet/core/tutorials/first-mvc-app/?view=aspnetcore-2.2 ). After completing this tutorial I was able to build a similar web app using a different product. For simplicity I will stick with the "Movie App" example from the tutorial to ask my question.

Below is the view of the basic CRUD application created.

I would like to provide some basic security for the web application. So far I have been unable to find a solution that meets my needs which are as follows:

• Simplicity. There will be only one user who needs any privileges and that is me. The privileges will be full use of CRUD features (I am the only one who can click on any of the blue link in the above image).
• No login requirements for the public. I would like anyone who visits to be able to be able to make a query from the search box (not shown in the picture) and see the results. I just don't want them to be able to make any changes.
• Not to have to spend too much time on security so I can continue learning in areas better suited to newer developers.

The bulk of the options I am finding are enterprise level, complex beyond my skill level at the moment, or require everyone to be a user. If I am the only user is there a way for me to easily create one user account and maybe a second factor like an IP lock? If not is there a better approach for me to take in tackling this issue?

Answer 1

OK, one thing you have to implement is "some" kind of security / Login - so that the application knows "someone" has logged in. In your case, it needs to know that "you" have logged in. So you have to implement some kind of basic Authentication mechanism, so that the user "identity" is known. You can take a look at basic cookie authentication here . You don't need to implement any major claims system - a simple authentication is enough (for your non production / learning scenarios).

Once you have implemented some kind of authentication / login system, after a successful login (authentication), the system knows that the "user" is authenticated. Then in your Razor code you could simply check for this condition & then remove the links for Unauthorized folks & on controllers you could add the "Authorize" attribute so that back-end code also checks for authenticated users for relevant functionality. eg: In Razor code, you could include conditional links to Edit / Delete etc, like so:

@if(User.Identity.IsAuthenticated) 
{
    //Include links for Edit / Delete
}

And you can include a mix of [Authorize] attribute on relevant controllers and [AllowAnonymous] on relevant methods.

Hope this helps. There is no escaping some basic understanding & work.