Does AllowAnonymous override AuthorizeAttribute

Question

I am trying to stop a particular user in a particular role(say RoleA) from accessing a particular action. Anonymous users are allowed to access, but a user in RoleA is not allowed to access the action.

So I did something like this:

[AllowAnonymous]
[CustomAuthorize(Roles="RoleB,RoleC")]
public ActionResult MyAction(){
  //irrelevant
}

But, the CustomAuthorize action filter is never hit, when [AllowAnonymous] is present.

So does [AllowAnonymous] override [CustomAuthorize]?

Answer 1

To answer the question as asked (a little late, but hey might be useful for someone):

AllowAnonymous has the following description:

Represents an attribute that marks controllers and actions to skip the AuthorizeAttribute during authorization.

Thus adding this along with an authorize attribute will result in the authorization code not running at all.

This also has the effect that if you add this as an attribute on your controller as a whole (i.e. at class level), then adding individual Authorize attributes to actions on that controller will have no effect.