Skip to main content
Client Center Buy
Menu

Restrict who can upload files in an ASP.NET Core editor

The editor's endpoints behind your authorization policy

By default, RichTextBox's endpoints are open: anyone who can reach your site can upload, browse the gallery and use your AI quota. That is convenient for a first try and wrong for production. The fix is one chained call, using the ASP.NET Core you already know.

Require sign-in

app.UseAuthentication();
app.UseAuthorization();

app.MapRichTextBoxUploads()
   .RequireAuthorization();

MapRichTextBoxUploads() returns an endpoint convention builder, so the convention applies to everything it maps together: upload, gallery, Word import and export, and the AI endpoints.

Only certain roles

Use a normal policy:

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("Editors", policy => policy.RequireRole("Editor", "Admin"));
});

app.MapRichTextBoxUploads().RequireAuthorization("Editors");

Now your claims, your roles and your login system decide. There is no second user system to keep in step.

Add a rate limit

builder.Services.AddRateLimiter(o => o.AddFixedWindowLimiter("editor", w =>
{
    w.PermitLimit = 30;
    w.Window = TimeSpan.FromMinutes(1);
}));

app.UseRateLimiter();

app.MapRichTextBoxUploads()
   .RequireAuthorization("Editors")
   .RequireRateLimiting("editor");

What this does not do

A policy on the group is all or nothing. The same people get upload, gallery browsing and folder creation together. RichTextBox has no built-in "may browse but not upload" role. If you need that, call the endpoints' routes with your own rules, or have your store refuse the operation for that user.

The toolbar is a separate matter too. Removing a button from someone's toolbar is a courtesy, and it does not stop them sending a request by hand. Only the policy on the server does. So do both: show fewer buttons to those who may not use them, and enforce the rule here.

Check it

Sign out and send a request directly. It should not get through:

curl -i "https://your-site/richtextbox/gallery"

Expect a 401, or a redirect to your login page, and no file list. Test this on your real site, because middleware order matters: UseAuthorization must run before the endpoints.

Read next