How to remove registration completely in ASP.NET Core 8.0 with Entity Framework Core?

I am building an application in which only admin can add student or teacher. I don't want anyone to register as a student or teacher. I am using ASP.NET Core 8.0 along with Entity Framework Core.

I added ASP.NET Core Identity. Then I deleted the register.cshtml and register.cshtml.cs files and also deleted the register button in the view. But if I know the URL https://localhost:7044/Identity/Account/Register?returnUrl=%2F of the register page, then I can still register.

How to solve this problem?

I want completely remove the registration even someone know the register link they also cant register.

I deleted the register.cshtml and register.cshtml.cs files and also deleted the register button in the view. But if I know the URL https://localhost:7044/Identity/Account/Register?returnUrl=%2F of the register page, then I can still register.

No, you don't need to delete those pages at all. It can be handled using couple of ways instead. You could use role base authentication, filters, or middleware to restrict the endpoint either accessing or registering new student or teacher.

I want completely remove the registration even someone know the register link they also cant register. How to remove registration completely in ASP.NET Core 8.0 with Entity Framework Core?

If you want to remove the register page or link or anything related to registration, you can do that by simply exclude those file from the project in following way:

So that, if you need them back, you can simply include again. Because deletion of code would always costs you.

Apart from that, you could set role based authentication, or filter or even middleware, so that only the authorized user could access the endpoint or register the new student or teacher this is ideal and elegant use case.

If you want to use role based authentication then can simply to that as following:

 [Authorize(Roles = "Admin")]
 public class RegisterModel : PageModel
 {
    

     public RegisterModel()
     {
      // Your constructior 
     }


     public class InputModel
     {
         //Your model 
     }
    
     public async Task OnGetAsync(string returnUrl = null)
     {
         ReturnUrl = returnUrl;
         ExternalLogins = (await _signInManager.GetExternalAuthenticationSchemesAsync()).ToList();
     }
     
     public async Task<IActionResult> OnPostAsync(string returnUrl = null)
     {
        
         return Page();
     }
 }

Thus, only admin could access this endpoint.

In addition, you could use the action filters as well. In that scenario, you should have your action method handler:

public class AdminOnlyAttribute : AuthorizeAttribute, IAsyncPageFilter
{
    public async Task OnPageHandlerSelectionAsync(PageHandlerSelectedContext context)
    {
        
    }

    public async Task OnPageHandlerExecutionAsync(PageHandlerExecutingContext context, PageHandlerExecutionDelegate next)
    {
        var user = context.HttpContext.User;
        if (!user.Identity.IsAuthenticated || !user.IsInRole("Admin"))
        {
            context.Result = new RedirectToActionResult("AccessDenied", "Account", null);
            return;
        }

        await next();
    }
}

Note: So without admin, registration page wouldn't be accessed and redirect to the AccessDenied page. If you need additional information, please refer to this official document. For middleware please check this.