The authorization filter goal is to restrict action methods individually, or by controller to specific users, roles, or claims. It always runs before the action is executed:
- A classic way to use the Authorization filter is to add this filter at the controller level, and override with the AllowAnonymous attribute at Action level, as shown in the following code:
[Authorize]public class AccountController : Controller{ [HttpGet] [AllowAnonymous] public IActionResult Login(string returnUrl = null) { ViewData["ReturnUrl"] = returnUrl; return View(); } [HttpGet] [AllowAnonymous] public IActionResult Register(string returnUrl = null) { ViewData["ReturnUrl"] = returnUrl; return View(); } [HttpPost] [ValidateAntiForgeryToken] public ...
