How do you implement role-based, using Forms Authentication and the Authorize attribute, Web.config?

Question

ICSM Computer · Answer

To implement role-based authorization using Forms Authentication, you can control access by assigning roles to users and then:
Using the [Authorize(Roles = "...")] attribute (in ASP.NET MVC or Web API), orDeclaring role restrictions in the web.config file (for Web Forms or general path-based protection).
Step-by-Step Guide
Step 1: Assign Roles to the User on Login
When authenticating a user, create a FormsAuthenticationTicket and
embed roles in the ticket:
Example (Login Code - Global.asax or Auth Controller)
string[] roles = { "Admin", "Manager" }; // Roles from DB
string userData = string.Join(",", roles); // Store roles in ticket
FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
    1,
    username,
    DateTime.Now,
    DateTime.Now.AddMinutes(30),
    false,
    userData // ← roles here
);
string encTicket = FormsAuthentication.Encrypt(ticket);
HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encTicket);
Response.Cookies.Add(cookie);
Step 2: Extract Roles on Each Request (Global.asax)
Hook into Application_AuthenticateRequest to extract the roles from the cookie and assign them to the current principal:
protected void Application_AuthenticateRequest(object sender, EventArgs e)
{
    HttpCookie authCookie = Context.Request.Cookies[FormsAuthentication.FormsCookieName];
    if (authCookie != null)
    {
        FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(authCookie.Value);
        string[] roles = ticket.UserData.Split(',');
        var identity = new FormsIdentity(ticket);
        var principal = new GenericPrincipal(identity, roles);
        Context.User = principal;
        Thread.CurrentPrincipal = principal;
    }
}
Option 1: Use [Authorize(Roles = "...")] (MVC/Web API)
Use the [Authorize] attribute to restrict controllers or actions:
[Authorize(Roles = "Admin")]
public ActionResult AdminPanel()
{
    return View();
}
[Authorize(Roles = "Admin,Manager")]
public ActionResult Reports()
{
    return View();
}
Option 2: Use andlt;authorizationandgt; in web.config
Use this for restricting folders/pages (Web Forms or static files):
andlt;location path="Admin"andgt;
  andlt;system.webandgt;
    andlt;authorizationandgt;
      andlt;allow roles="Admin" /andgt;
      andlt;deny users="*" /andgt;
    andlt;/authorizationandgt;
  andlt;/system.webandgt;
andlt;/locationandgt;
You can also restrict specific pages:
andlt;location path="Reports.aspx"andgt;
  andlt;system.webandgt;
    andlt;authorizationandgt;
      andlt;allow roles="Manager,Admin" /andgt;
      andlt;deny users="*" /andgt;
    andlt;/authorizationandgt;
  andlt;/system.webandgt;
andlt;/locationandgt;
Summary
Method
Usage
FormsAuthenticationTicket
Embed roles in ticket via UserData
Application_AuthenticateRequest
Extract and assign roles on every request
[Authorize(Roles = "...")]
Role-based access for MVC/Web API
web.config andlt;authorizationandgt;
Role-based access for static pages or folders
and

interview

How do you implement role-based, using Forms Authentication and the Authorize attribute, Web.config?

ICSM Computer

Can you answer this question?

1 Answers

Step-by-Step Guide

Step 1: Assign Roles to the User on Login

Example (Login Code - Global.asax or Auth Controller)

Step 2: Extract Roles on Each Request (Global.asax)

Option 1: Use `[Authorize(Roles = "...")]` (MVC/Web API)

Option 2: Use `<authorization>` in `web.config`

Summary

Liked By

Method	Usage
`FormsAuthenticationTicket`	Embed roles in ticket via `UserData`
`Application_AuthenticateRequest`	Extract and assign roles on every request
`[Authorize(Roles = "...")]`	Role-based access for MVC/Web API
`web.config` `<authorization>`	Role-based access for static pages or folders

interview

How do you implement role-based, using Forms Authentication and the Authorize attribute, Web.config?

ICSM Computer

Can you answer this question?

1 Answers

Step-by-Step Guide

Step 1: Assign Roles to the User on Login

Example (Login Code - Global.asax or Auth Controller)

Step 2: Extract Roles on Each Request (Global.asax)

Option 1: Use [Authorize(Roles = "...")] (MVC/Web API)

Option 2: Use <authorization> in web.config

Summary

Liked By

Option 1: Use `[Authorize(Roles = "...")]` (MVC/Web API)

Option 2: Use `<authorization>` in `web.config`