title: How can I implement [Authorize(roles="admin")] attribute on top of method name in asp.net framework 4.5.2?
body: <p>As I mentioned in the title I want to do the authorization in my application. I have created application in no authentication mode. Now I want to apply authorization by using <code>Authorize</code> keyword and want to give the access to the method for admins only. I want to restrict other users to see that method body.</p>
  
  <p>I have made changes in my <code>web.config</code> file.:</p>
  
  <pre><code>&lt;configuration&gt;
    &lt;configSections&gt;
      &lt;!-- For more information on Entity Framework configuration, visit http://go.microsoft.com/fwlink/?LinkID=237468 --&gt;
      &lt;section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" /&gt;
    &lt;/configSections&gt;
    &lt;appSettings&gt;
      &lt;add key="webpages:Version" value="3.0.0.0" /&gt;
      &lt;add key="webpages:Enabled" value="false" /&gt;
      &lt;add key="ClientValidationEnabled" value="true" /&gt;
      &lt;add key="UnobtrusiveJavaScriptEnabled" value="true" /&gt;
    &lt;/appSettings&gt;
    &lt;system.web&gt;
      &lt;compilation debug="true" targetFramework="4.5.2" /&gt;
      &lt;httpRuntime targetFramework="4.5.2" /&gt;
      &lt;authentication mode="Forms"&gt;
        &lt;forms loginUrl="Home/Login"&gt;
        &lt;/forms&gt;
      &lt;/authentication&gt;
      &lt;roleManager  enabled="true" defaultProvider="MyProvider"&gt;
        &lt;providers&gt;
          &lt;clear /&gt;
          &lt;add name="MyProvider" type="testingapp.MyRoleProvider"/&gt;
        &lt;/providers&gt;
      &lt;/roleManager&gt;
      &lt;authorization&gt;
        &lt;allow roles="admin"/&gt;
  
      &lt;/authorization&gt;
    &lt;/system.web&gt;
    &lt;runtime&gt;
      &lt;assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1"&gt;
        &lt;dependentAssembly&gt;
          &lt;assemblyIdentity name="Newtonsoft.Json" culture="neutral" publicKeyToken="30ad4fe6b2a6aeed" /&gt;
          &lt;bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0" /&gt;
        &lt;/dependentAssembly&gt;
        &lt;dependentAssembly&gt;
          &lt;assemblyIdentity name="System.Web.Optimization" publicKeyToken="31bf3856ad364e35" /&gt;
          &lt;bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="1.1.0.0" /&gt;
        &lt;/dependentAssembly&gt;
        &lt;dependentAssembly&gt;
          &lt;assemblyIdentity name="WebGrease" publicKeyToken="31bf3856ad364e35" /&gt;
          &lt;bindingRedirect oldVersion="0.0.0.0-1.5.2.14234" newVersion="1.5.2.14234" /&gt;
        &lt;/dependentAssembly&gt;
        &lt;dependentAssembly&gt;
          &lt;assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" /&gt;
          &lt;bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" /&gt;
        &lt;/dependentAssembly&gt;
        &lt;dependentAssembly&gt;
          &lt;assemblyIdentity name="System.Web.WebPages" publicKeyToken="31bf3856ad364e35" /&gt;
          &lt;bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" /&gt;
        &lt;/dependentAssembly&gt;
        &lt;dependentAssembly&gt;
          &lt;assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" /&gt;
          &lt;bindingRedirect oldVersion="1.0.0.0-5.2.3.0" newVersion="5.2.3.0" /&gt;
        &lt;/dependentAssembly&gt;
      &lt;/assemblyBinding&gt;
    &lt;/runtime&gt;
    &lt;system.codedom&gt;
      &lt;compilers&gt;
        &lt;compiler language="c#;cs;csharp" extension=".cs" type="Microsoft.CodeDom.Providers.DotNetCompilerPlatform.CSharpCodeProvider, Microsoft.CodeDom.Providers.DotNetCompilerPlatform, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" warningLevel="4" compilerOptions="/langversion:6 /nowarn:1659;1699;1701" /&gt;
        &lt;compiler language="vb;vbs;visualbasic;vbscript" extension=".vb" type="Microsoft.CodeDom.Providers.DotNetCompilerPlatform.VBCodeProvider, Microsoft.CodeDom.Providers.DotNetCompilerPlatform, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" warningLevel="4" compilerOptions="/langversion:14 /nowarn:41008 /define:_MYTYPE=\&amp;quot;Web\&amp;quot; /optionInfer+" /&gt;
      &lt;/compilers&gt;
    &lt;/system.codedom&gt;
    &lt;system.webServer&gt;
      &lt;validation validateIntegratedModeConfiguration="false" /&gt;
      &lt;modules&gt;
        &lt;remove name="ApplicationInsightsWebTracking" /&gt;
        &lt;add name="ApplicationInsightsWebTracking" type="Microsoft.ApplicationInsights.Web.ApplicationInsightsHttpModule, Microsoft.AI.Web" preCondition="managedHandler" /&gt;
      &lt;/modules&gt;
    &lt;/system.webServer&gt;
    &lt;connectionStrings&gt;
      &lt;add name="testingEntities" connectionString="metadata=res://*/Models.Model1.csdl|res://*/Models.Model1.ssdl|res://*/Models.Model1.msl;provider=System.Data.SqlClient;provider connection string=&amp;quot;data source=.\SQLEXPRESS;initial catalog=testing;integrated security=True;MultipleActiveResultSets=True;App=EntityFramework&amp;quot;" providerName="System.Data.EntityClient" /&gt;
    &lt;/connectionStrings&gt;
    &lt;entityFramework&gt;
      &lt;defaultConnectionFactory type="System.Data.Entity.Infrastructure.SqlConnectionFactory, EntityFramework" /&gt;
      &lt;providers&gt;
        &lt;provider invariantName="System.Data.SqlClient" type="System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer" /&gt;
      &lt;/providers&gt;
    &lt;/entityFramework&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>I have written following custom role provider class named <code>MyRoleProvider</code>:</p>
  
  <pre><code>using System;
  using System.Collections.Generic;
  using System.Linq;
  using System.Web;
  using System.Web.Security;
  
  namespace testingapp
  {
      public class MyRoleProvider : RoleProvider
      {
          public override string ApplicationName
          {
              get
              {
                  throw new NotImplementedException();
              }
  
              set
              {
                  throw new NotImplementedException();
              }
          }
  
          public override void AddUsersToRoles(string[] usernames, string[] roleNames)
          {
              throw new NotImplementedException();
          }
  
          public override void CreateRole(string roleName)
          {
              throw new NotImplementedException();
          }
  
          public override bool DeleteRole(string roleName, bool throwOnPopulatedRole)
          {
              throw new NotImplementedException();
          }
  
          public override string[] FindUsersInRole(string roleName, string usernameToMatch)
          {
              throw new NotImplementedException();
          }
  
          public override string[] GetAllRoles()
          {
              throw new NotImplementedException();
          }
  
          public override string[] GetRolesForUser(string username)
          {
              throw new NotImplementedException();
          }
  
          public override string[] GetUsersInRole(string roleName)
          {
              throw new NotImplementedException();
          }
  
          public override bool IsUserInRole(string username, string roleName)
          {
              throw new NotImplementedException();
          }
  
          public override void RemoveUsersFromRoles(string[] usernames, string[] roleNames)
          {
              throw new NotImplementedException();
          }
  
          public override bool RoleExists(string roleName)
          {
              throw new NotImplementedException();
          }
      }
  }
  </code></pre>
  
  <p>I want to give authorization to my contact method from the home controller.</p>
  
  <pre><code>using System;
  using System.Collections.Generic;
  using System.Linq;
  using System.Web;
  using System.Web.Mvc;
  using System.Web.Security;
  using testingapp.Models;
  
  namespace testingapp.Controllers
  {
      public class HomeController : Controller
      {
          testingEntities db = new testingEntities();
          public ActionResult Index()
          {
              return View();
          }
  
          public ActionResult About()
          {
              ViewBag.Message = "Your application description page.";
  
              return View();
          }
          [Authorize(Roles ="admin")]
          public ActionResult Contact()
          {
              ViewBag.Message = "Your contact page.";
  
              return View();
          }
          [HttpGet]
          public ActionResult Login()
          {
              return View();
          }
  
          //Login Post Method
          [HttpPost]
          [ValidateAntiForgeryToken]
          // [Route("account/login")]
          public ActionResult Login(Testingtable user)
          {
              if (db.Testingtables.Any(u =&gt; u.EmailID == user.EmailID &amp;&amp; u.Password == user.Password))
              {
                  //checking username and password
                  var usr = db.Testingtables.Single(u =&gt; u.EmailID == user.EmailID &amp;&amp; u.Password == user.Password);
                  //Keeping data in sessions
  
                  return RedirectToAction("Index", "Home");
              }
              else
              {
                  return View(user);
              }
          }
  
          //Logout Method
          public ActionResult Logout()
          {
              FormsAuthentication.SignOut();
              Session.Clear();
              Session.Abandon();
              Response.ClearHeaders();
              //After logout it redirects to login page
              return RedirectToAction("Login", "Home");
          }
      }
  }
  </code></pre>