Adjust authorization check to include AllowAnonymous attribute

Etherna · Sep 24, 2024 · 7c7ac85 · 7c7ac85
1 parent eb517b1
commit 7c7ac85
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/src/EthernaACR/Conventions/RouteTemplateAuthorizationConvention.cs b/src/EthernaACR/Conventions/RouteTemplateAuthorizationConvention.cs
@@ -42,10 +42,11 @@ public void Apply(ApplicationModel application)
                         routeTemplate,
                         StringComparison.OrdinalIgnoreCase) ?? false);
 
-                //give priority to authorize attribute
-                var hasAuthorizeAttribute = controller.Attributes.OfType<AuthorizeAttribute>().Any(); 
+                //give priority to Authorize and AllowAnonymous attributes
+                var hasAuthAttributes = controller.Attributes.OfType<AllowAnonymousAttribute>().Any() ||
+                                        controller.Attributes.OfType<AuthorizeAttribute>().Any(); 
 
-                if (isInRouteTemplate && !hasAuthorizeAttribute)
+                if (isInRouteTemplate && !hasAuthAttributes)
                     controller.Filters.Add(new AuthorizeFilter(policyName));
             }
         }