Basic authentication in ASP.NET MVC 5

You can use this simple yet effective mechanism using a custom ActionFilter attribute:

public class BasicAuthenticationAttribute : ActionFilterAttribute{    public string BasicRealm { get; set; }    protected string Username { get; set; }    protected string Password { get; set; }    public BasicAuthenticationAttribute(string username, string password)    {        this.Username = username;        this.Password = password;    }    public override void OnActionExecuting(ActionExecutingContext filterContext)    {        var req = filterContext.HttpContext.Request;        var auth = req.Headers["Authorization"];        if (!String.IsNullOrEmpty(auth))        {            var cred = System.Text.ASCIIEncoding.ASCII.GetString(Convert.FromBase64String(auth.Substring(6))).Split(':');            var user = new { Name = cred[0], Pass = cred[1] };            if (user.Name == Username && user.Pass == Password) return;        }        filterContext.HttpContext.Response.AddHeader("WWW-Authenticate", String.Format("Basic realm=\"{0}\"", BasicRealm ?? "Ryadel"));        /// thanks to eismanpat for this line: http://www.ryadel.com/en/http-basic-authentication-asp-net-mvc-using-custom-actionfilter/#comment-2507605761        filterContext.Result = new HttpUnauthorizedResult();    }}

It can be used to put under Basic Authentication a whole controller:

[BasicAuthenticationAttribute("your-username", "your-password",     BasicRealm = "your-realm")]public class HomeController : BaseController{   ...}

or a specific ActionResult:

public class HomeController : BaseController{    [BasicAuthenticationAttribute("your-username", "your-password",         BasicRealm = "your-realm")]    public ActionResult Index()     {        ...    }}

In case you need additional info check out this blog post that I wrote on the topic.

You can do this with a custom attribute. There is an implementation of a custom attribute that supports base authentication in the open source project SimpleSecurity, which you can download here. There is a reference application to demonstrate how it is used. It was originally developed to work with SimpleMembership in MVC 4 and has been recently ported to use ASP.NET Identity in MVC 5.

I wanted to amend the answer shared by Darkseal, because that code has a major security flaw. As written, that action filter does not actually terminate the request when res.End() is called. The user is prompted for credentials and a 401 response is returned if the credentials don't match, but the controller action is still executed on the server side. You need to set the filterContext.Result property to something in order for the request to terminate properly and not continue to the action method.

This was particularly bad for my situation, as I was trying to protect a web service endpoint that receives a data feed from a third party. As written, this action filter didn't protect anything because the data was still being pushed through my action method.

My "quick fix" is below:

public class BasicAuthenticationAttribute : ActionFilterAttribute{    public string BasicRealm { get; set; }    protected string Username { get; set; }    protected string Password { get; set; }    public BasicAuthenticationAttribute(string username, string password)    {        this.Username = username;        this.Password = password;    }    public override void OnActionExecuting(ActionExecutingContext filterContext)    {        var req = filterContext.HttpContext.Request;        var auth = req.Headers["Authorization"];        if (!String.IsNullOrEmpty(auth))        {            var cred = System.Text.ASCIIEncoding.ASCII.GetString(Convert.FromBase64String(auth.Substring(6))).Split(':');            var user = new { Name = cred[0], Pass = cred[1] };            if (user.Name == Username && user.Pass == Password) return;        }        var res = filterContext.HttpContext.Response;        res.AddHeader("WWW-Authenticate", String.Format("Basic realm=\"{0}\"", BasicRealm ?? "Ryadel"));        filterContext.Result = new HttpUnauthorizedResult();    }}