ASP.NET Web API Override authorization filter for a handler

Question

How can I disable an authorization filter for a specific GET handler in Web API?

There's a custom authorization filter on the class level but for one of the methods I need to have no security. I tried applying [AllowAnonymous] attribute but it still runs through the higher-level filter and fails. That custom filter derives from AuthorizationFilterAttribute. The class also have two another attributes: OverrideAuthentication and EnableCors.

I tried AllowAnonymous attribute but it doesn't.

Sample code:

[EnableCors(origins: "*", headers: "*", methods: "*")]
[OverrideAuthentication]
[AccountAuthorization]
public class AccountsController : ApiController
{

    [Route("api/accounts/{accountNumber}/GetX")]
    [AllowAnonymous]
    [HttpGet]
    public HttpResponseMessage GetX(string accountNumber)
    {
        HttpResponseMessage response = null;
        IEnumerable<string> apiKey;
        if (!Request.Headers.TryGetValues("X-ApiKey", out apiKey) || apiKey.Count() != 1 || apiKey.First() != API_KEY)
        {
            throw new HttpResponseException(HttpStatusCode.Forbidden);
        }

        // Process
        // ..
        // ..

        return response;
    }
}

EDIT: The linked answer doesn't explain what's the solution.

What if you remove [OverrideAuthentication] and [AccountAuthorization] from the controller? — Max Sorin
– Max Sorin, Commented Apr 11, 2016 at 21:12
Possible duplicate of AllowAnonymous not working with Custom AuthorizationAttribute — Steve Czetty
– Steve Czetty, Commented Apr 11, 2016 at 21:15
See this too, you may be able to allow anonymous on specific URLs in the web api.. stackoverflow.com/questions/14588397/… — David Oesterreich
– David Oesterreich, Commented Apr 11, 2016 at 21:18
Then you are intercepting the request elsewhere that is not visible to us. — Max Sorin
– Max Sorin, Commented Apr 11, 2016 at 21:42

Shikasta_Kashti · Accepted Answer · 2016-04-12 15:32:00Z

3

Figured it out at last.

Since there is already an existing custom authorization filter on the class/controller level, therefore, to override a specific action handler (the method) and have it work without any authorization filters, we need to override the filter at the controller/class level. So adding the OverrideAuthorization filter did the trick. Now AllowAnonymous will be to do its magic.

[Route("api/accounts/{accountNumber}/GetX")]
[AllowAnonymous]
[OverrideAuthorization]
[HttpGet]
public HttpResponseMessage GetX(string accountNumber)
{
    // Process     
    // ..
    // ..
}

edited Apr 12, 2016 at 15:32

answered Apr 12, 2016 at 15:26

Shikasta_Kashti

7912 gold badges15 silver badges29 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

ASP.NET Web API Override authorization filter for a handler

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related