The description of interaction of Authorize and AllowAnonymous attrbiutes could be improved.

[voroninp]

Description

There's a note:

If you combine [AllowAnonymous] and an [Authorize] attribute, the [Authorize] attributes are ignored.

This is not completely true, and below you provide an indirect proof:

Authentication middleware is not short-circuited but doesn't need to succeed.

It's worth explicitly saying, that schemes specified in AuthenticationSchemes property of [Authorize] attribute will be used for authentication.

Page URL

https://learn.microsoft.com/en-us/aspnet/core/security/authorization/simple?view=aspnetcore-8.0#use-the-authorize-attribute

Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/authorization/simple.md

Document ID

cea5942d-fb01-f5bf-3b63-25873d5b79cf

Article author

@Rick-Anderson

Related Issues