Description

The warning makes it sound like the AllowAnonymous disables authorization all together. But it does not. If a method has both [AllowAnonymous] and [Authorize()] attributes applied, and the client sends credentials to the endpoint, the endpoint will authenticate the credentials and log the user in. Only if there are no credentials will it run as anonymous.

Page URL

https://learn.microsoft.com/en-us/aspnet/core/diagnostics/asp0026?view=aspnetcore-9.0

Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/diagnostics/asp0026.md

Document ID

d2c79b3f-f7d7-d5db-c488-57feda9e17a6

Platform Id

2ca4a99f-2dd5-1fbd-4be8-4e55e6c51203

Article author

@tdykstra

Metadata

• ID: d2c79b3f-f7d7-d5db-c488-57feda9e17a6
• PlatformId: 2ca4a99f-2dd5-1fbd-4be8-4e55e6c51203
• Service: aspnet-core

Related Issues

Associated WorkItem - 506179