Is it possible to disable authorization on one action in an MVC controller?

Question

I have an authorization attribute on a controller, but I'd like to turn it off on one action. I created my own authorization filter and added "Anonymous" into the Roles list. In my filter I then return true if Anonymous appears in the role list.

However, it doesn't seem to get past the login page as if the controller authorization is pre-empting anything else.

Answer 1

You can add [Authorize] To the controller class, and then add [AllowAnonymous] to the single action you don't want to be authorized. Example:

[Authorize] public class AccountController : Controller {     public ActionResult Profile()     {         return View();     }      [AllowAnonymous]     public ActionResult Login()     {         return View();     } } 

Answer 2

You can create your own version of the attribute.

There is a very similar question and there is a pretty good answer how to implement your own attribute that handles this situation.

Override Authorize Attribute in ASP.NET MVC

Btw. you could also create your controller that would have authorization by default.

Base

[Authorize] public abstract class SecureControllerBase : Controller { } 

Usage

public class MyController : SecureControllerBase { }