ASP.NET Core Interview Question #138

What does the AllowAnonymous attribute do?

Authentication, Authorization & Security Mid-Level Intermediate

Quick Interview Answer

AllowAnonymous marks an action, controller, page, or endpoint as accessible without satisfying normal authorization requirements applied at a broader level.

Detailed Explanation

AllowAnonymous marks an action, controller, page, or endpoint as accessible without satisfying normal authorization requirements applied at a broader level.

It is commonly used for login, registration, public landing pages, or health endpoints that are intentionally public. It should be applied deliberately because it can override authorization expectations for that endpoint.

Code Example

[Authorize]
public class AccountController : Controller
{
    public IActionResult Profile() => View();

    [AllowAnonymous]
    public IActionResult Login() => View();
}