AspNetCore.Docs
AspNetCore.Docs copied to clipboard
dotnet
Misleading statement about Authorize/AllowAnoynmous override
The document in its current form leads one to believe that combining Authorize with AllowAnonymous on a controller will lead to Authorize being ignored, this is only partially true.
What really happens is that the result of the authorization is ignored it is, however, still performed.
This behavior means that the authentication pipeline will indeed run and you will have access to the User Identity in the HttpContext if the user was authenticated.
This can be seen as an alternative to calling HttpContext.AuthenticateAsync() within the controller if you have an endpoint that switches on the authentication state anyway.
Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.
- ID: 4c3930e5-8a4f-8bdf-7167-9aed8afc4253
- Version Independent ID: cea5942d-fb01-f5bf-3b63-25873d5b79cf
- Content: Simple authorization in ASP.NET Core
- Content Source: aspnetcore/security/authorization/simple.md
- Product: aspnet-core
- Technology: aspnetcore-security
- GitHub Login: @Rick-Anderson
- Microsoft Alias: riande
It states
You can also use the AllowAnonymous attribute to allow access by non-authenticated users to individual actions.
Correct, but directly below that it states:
[!WARNING] [AllowAnonymous] bypasses all authorization statements. If you combine [AllowAnonymous] and any [Authorize] attribute, the [Authorize] attributes are ignored. For example if you apply [AllowAnonymous] at the controller level, any [Authorize] attributes on the same controller (or on any action within it) is ignored.
Which to me signals that Authorize attributes aren't even processed, which isn't true. Authentication middleware does run.
Which to me signals that Authorize attributes aren't even processed, which isn't true. Authentication middleware does run.
It just states the authorization is bypassed. It doesn't state the middleware doesn't run.
The thing is, middleware doesn't run if there is no [Authorize] attribute. So the presence of the [Authorize] attribute has an effect. Which the Warning posted above implies it doesn't have because [AllowAnonymous] would lead to [Authorize] being ignored.
Its just a detail that might be nice to add to the text as a clarification, saying:
If Authorize is present Authentication middleware runs, if AllowAnonymous is also present the result of the Authentication middleware is ignored and all requests are processed by the endpoint.
I would word this something to the effect of, "Authorization requirements specified by [Authorize] will be ignored, but any related authentication will still be done."
