Check AllowAnonymousAttribute in Web API

Question

System.Web.Mvc.ActionDescriptor has method IsDefined which helps to determine whether one or more instances of the specified attribute type are defined for this member.

System.Web.Http.Controllers.HttpActionDescriptor does not have this method.

How can I check AllowAnonymousAttribute using HttpActionDescriptor?

Answer 1

I found. I can use GetCustomAttributes method. For example (from AuthorizeAttribute implementation):

private static bool SkipAuthorization(HttpActionContext actionContext)
{
  if (!Enumerable.Any<AllowAnonymousAttribute>((IEnumerable<AllowAnonymousAttribute>) actionContext.ActionDescriptor.GetCustomAttributes<AllowAnonymousAttribute>()))
    return Enumerable.Any<AllowAnonymousAttribute>((IEnumerable<AllowAnonymousAttribute>) actionContext.ControllerContext.ControllerDescriptor.GetCustomAttributes<AllowAnonymousAttribute>());
  else
    return true;
}

Answer 2

The answer by @FireShock is correct, here is a version that I think is easier to read:

private static bool ShouldSkipAuthorization(HttpActionContext actionContext)
{
    return 
        actionContext.ActionDescriptor.GetCustomAttributes<AllowAnonymousAttribute>(true).Any() ||
        actionContext.ActionDescriptor.ControllerDescriptor.GetCustomAttributes<AllowAnonymousAttribute>(true).Any();
}