CODEWITHSUNDEEP
asp.net-mvc-3authenticationauthorize
ekkis
ekkis

Reputation: 10236

Authorisation exceptions

I've tagged my controller with an authority annotation but would like to exempt one of the methods... can that be done? how?

[Authorize(Roles="Admin")]
public class ProductController : Controller
{
    [DEAUTHORIZE]
    public ActionResult Start(int it)
    { ... }

Upvotes: 1

Views: 701

Answers (2)

Lukáš Kotrba
Lukáš Kotrba

Reputation: 836

In MVC 4 was introduced AllowAnonymousAttribute which tells action invoker to skip AuthorizeAttribute.

[AllowAnonymous]

Upvotes: 4

Darin Dimitrov
Darin Dimitrov

Reputation: 1039408

No, this can't be done. The standard way to achieve this is to simply move the Start action out in a separate controller. Another possibility consists into building a custom IFilterProvider which will apply the authorization attribute conditionally instead of baking it manually into the ProductController. For example NInject uses this and provides a pretty fluent syntax into configuring action filters. You can conditionally apply them based on the current context.

Upvotes: 2

Related Questions