ASP.NET MVC 3 Present Web User Challenge?

In the ASP.NET Webforms days, I had an 开发者_JS百科HTTP Module that presented a 401 challenge to get the user name/password, authenticate, and move on. I did with Basic Authentication over SSL to be compatible across many different browsers, and also to use a central database store for checking credentials.

With the latest MVC bits, I am looking for a way to do the same thing. What is the proper/modern method to do that? Is Forms Auth the only way these days? I really need to present the familiar "logon box" to the users.

Thanks.

Is Forms Auth the only way these days?

Forms authentication is just an authentication method. You could also use Integrated Windows Authentication, basic, digest, OpenID, or some other scheme. But no matter which type of authentication you are using, in ASP.NET MVC you decorate your controllers/actions (which require authentication) with the [Authorize] attribute. Or if you need more control you could write a custom authentication attribute deriving from the standard one.

If you are still looking to use that module, you can possibly but beware that URL based authorization is difficult in MVC because of the many urls and changes that make url access tricky. RESTful urls can change often and multiple URLs (ok URIs) can map to the same location. In MVC, as Darin noted, the important thing is to use [Authorize] on the controller class or methods. The idea here is no matter what the URI used to access the current resource, you know the permissions will be correct.

When the attribute is processed user role membership will be checked and if not redirect to whatever login url you want (assuming for instance forms auth) but this can be configured by your authentication provider to do 'whatever action' if the user isn't authorized. In the case of windows authentication you would be prompted with a login dialog as would be done via a 401 challenge which is why I say you can possibly still use your method.

Windows auth as an example is done here: Windows Auth in MVC