Authorization issue while add AllowAnonymous at controller level

Question

When I put the [AllowAnonymous] attribute at the controller level and the [Authorize] attribute at the method level then Authorize is not working if I removed AllowAnonymous from the controller then it's working.

Naimish Makwana · Answer

In ASP.NET, when you use the [AllowAnonymous] attribute at the controller level, you are essentially telling ASP.NET that all the actions (methods) within that controller are exempt from authorization checks. This means that even if you use the [Authorize] attribute on individual methods within the controller, those methods will still be accessible without authentication because the controller-level [AllowAnonymous] attribute takes precedence. If you want to have some actions within the controller that are authorized while others are not, you should remove the [AllowAnonymous] attribute from the controller level and apply the [Authorize] attribute only to the specific methods (actions) that need authorization. Here's an example of how you can do that: [Authorize] // Apply authorization at the controller level if all methods need it public class MyController : Controller { [AllowAnonymous] // Exempt this action from authorization public IActionResult PublicAction() { // This action can be accessed without authentication return View(); } public IActionResult AuthorizedAction() { // This action requires authentication return View(); } } Thanks Naimish Makwana

Jignesh Kumar · Answer

Hello Alpesh, You have done reverse, you should add [Authorize] at controller level and [AllowAnonymous] at action method level. If you do this change then it should work for you.

Tuhin Paul · Answer

[ApiController] [Route("[controller]")] public class MyController { [AllowAnonymous] // Allow anonymous access to this specific method [HttpGet("public-data")] public IActionResult GetPublicData() { // ... return public data } [Authorize] // Require authorization for this method [HttpGet("private-data")] public IActionResult GetPrivateData() { // ... return private data } } GetPublicData allows anonymous access because of [AllowAnonymous] . GetPrivateData requires authorization because only [Authorize] is present. Use [AllowAnonymous] sparingly only on specific methods that genuinely need anonymous access.

Tuhin Paul · Answer

Behavior of `[AllowAnonymous] at Controller Level: When you apply [AllowAnonymous] to a controller, it essentially bypasses all authorization checks for all actions within that controller. This means any method in the controller, regardless of having an [Authorize] attribute, will be accessible to unauthenticated users. Conflicting Attributes: The presence of [AllowAnonymous] on the controller takes precedence over [Authorize] on individual methods. This creates a conflict, essentially telling the authorization system to bypass checks even though specific methods require authorization. Solution: To achieve the desired behavior where some methods require authorization and others allow anonymous access, use [AllowAnonymous] only on specific methods within the controller that should be accessible without authentication.

Jaimin Shethiya · Answer

Hello Alpesh, Yes that is now working for Authorize because you have added the AllowAnonymous attribute. If you want both then it is not possible. If you want to each an every endopint via executable with the Authorize attribute then you need to implement Authorization based on either Role or Policy based authorization.

Jaimin Shethiya · Answer

Hello @Alpesh, You are doing the reverse case, you need to add [Authorize] attribute at controller level and [AllowAnonymous] attribute add in the endpoints level. [Authorize] public class TestController : Controller { [AllowAnonymous] [HttpGet] public IActionResult Get() { .... .... return Ok(); } [HttpPost] public IActionResult Post(Model model) { ..... ..... return Ok(model); } } Thanks