ASP.NET Core MVC Interview Question #105

What does the [AllowAnonymous] attribute do?

Authentication, Authorization, Security & State Management Mid-Level Intermediate

Quick Interview Answer

AllowAnonymous marks an endpoint as not requiring authorization even when authorization is applied more broadly, such as at controller level.

Detailed Explanation

AllowAnonymous marks an endpoint as not requiring authorization even when authorization is applied more broadly, such as at controller level.

Typical examples include login, registration, password-recovery, or public information actions. It should be used intentionally because it overrides authorization requirements that would otherwise apply.

Code Example

[Authorize]
public class AccountController : Controller
{
    [AllowAnonymous]
    public IActionResult Login()
    {
        return View();
    }
}