Override ASP.NET Authorization annotations

Question

Is there a way to override Authorize annotation in ASP.Net?

I'm using MVC and my controller is annotated with:

[Authorize(Roles="Admin")]

The majority of actions in this controller are restricted to Admin users.

I would like to override one action method so that it becomes available to all users:

[HttpPost]
[Authorize(Users="*")]        
public Boolean Submit(FormCollection collection)

This is not working and users are being re-directed to login page. What am I doing wrong?

Thank you.

Phil wrote a blog post how to apply a filter for every action except one. Here's the link. — frennky
– frennky, Commented May 31, 2011 at 14:57
There is blog post by Rick Anderson that tries to solve the scenario you mentioned in an elegant way. — Chandermani
– Chandermani, Commented May 31, 2011 at 15:05

Eduard · Accepted Answer · 2011-05-31 13:23:25Z

6

I think you should be able to achieve what you are trying to do by simply removing the attribute from controller and move it to methods only where needed.

answered May 31, 2011 at 13:23

Eduard

3,2163 gold badges23 silver badges31 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Nathan · Accepted Answer · 2011-05-31 13:30:14Z

1

The class level attribute is being checked first, causing the behaviour you describe.

You would need to put the less restrictive role on the class attribute and then put the more restrictive role attribute on the relevant actions.

edited May 31, 2011 at 13:30

answered May 31, 2011 at 13:23

Nathan

6,2244 gold badges38 silver badges66 bronze badges

Collectives™ on Stack Overflow

Override ASP.NET Authorization annotations

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related