Unit Testing Authorization on your Controllers

One option to configure authorization in .NET Core, is to call RequireAuthorization like this:

app.UseEndpoints(endpoints =>
{
  endpoints.MapControllerRoute(
            name: "default",
            pattern: "{controller=Home}/{action=Index}/{id?}").RequireAuthorization();
});

There are many different variations to this with tons of options, including defining policies with fallbacks so everything is protected by default. For more information, checkout these links:

• Globally Require Authenticated Users By Default Using Fallback Policies in ASP.NET Core
• Setting global authorization policies using the DefaultPolicy and the FallbackPolicy in ASP.NET Core 3.x
• How can we set authorization for a whole area in ASP.NET MVC?

Whether or not you set up global authentication, you can use explicit Authorize and AllowAnonymous attributes on your controllers. For example:

[Authorize]
public class HomeController : Controller
{
  ...
}

With this example you would not block everything by default in Startup but authorize specific controllers only. In this case, that would mean that all your endpoints are publicly available except for the ones marked with the Authorize attribute. Alternatively, you could globally block everything (for example using RequireAuthorization as explained above, or with a global AuthorizeFilter in .NET Core or a global AuthorizeAttribute in earlier versions of .NET before Core) and then selectively open up some controllers or action methods:

[AllowAnonymous]
public class HomeController : Controller
{
  ...
}

For the scenario where not everything is blocked and only specific controllers require authorization, it's a good idea to set up unit tests to ensure the controllers that require authorization have the attribute set. It can be a single unit test that checks all controllers in your project for the Authorize attribute, with an option to exclude certain controllers explicitly. For that to work, you need some code that finds all controller types and then checks them for the presence of the Authorize attribute. To get the controllers, you can write your own reflection code, or make use of an existing library. In many of my projects that have unit tests I use the FluentAssertions library for easy testing my assertions. That library also comes with a handy AllTypes that provides access to the type system in an easy way. So instead of inventing my own wheel, I usually use that class to find all controller types. The full test could look like this:

[TestClass]
public class ControllerTests
{
  [TestMethod]
  public void AllControllersShouldImplementAuthorizeAttribute()
  {
    var excludedTypes = new[]
    {
      typeof(HomeController)
    };
    var assembly = Assembly.GetAssembly(typeof(HomeController));
    var allControllers = AllTypes.From(assembly).ThatDeriveFrom<Controller>().Except(excludedTypes);
    var controllersWithoutAuthorizeAttribute = allControllers.Where(t => !t.IsDefined(typeof(AuthorizeAttribute), false)).ToList();
    var brokenControllers = string.Join(" and ", controllersWithoutAuthorizeAttribute.Select(x => x.Name));
    controllersWithoutAuthorizeAttribute.Count.Should().Be(0, "because {0} should have the Authorize attribute", brokenControllers);
  }
}    

With this unit test in place, imagine I have two controllers: HomeController (excluded in the list above) and SecondController:

public class HomeController : Controller
{
}

public class SecondController : Controller
{
}  

If I run the test now, my test output will look like this (I run my tests with ReSharper so that's what you see in the screenshot below, but other test runners will show similar output):

If you add the Authorize attribute to SecondController or add it the exclusions list, the test will pass:

You can extend this code to support other scenarios such as controllers in multiple projects (and thus attributes) and other configured default behavior for authentication in Startup.

Note: although this snippet is placed in the ASP.NET Core category and the authorization configuration code targets Core as well, you can use the same unit test code and FluentAssertions library on your ASP.NET Framework applications.

Happy testing!