liveBook · Manning

AllowAnonymous

As explained in ASP.NET Core in Action, 3e

AllowAnonymous is an ASP.NET Core attribute that permits access to an endpoint, action, or Razor Page without authentication.

AllowAnonymous permits unauthenticated users to execute a specific action, Razor Page, or API endpoint. Use it when authorization is applied globally or to a broader controller, route group, or endpoint. section 24.2.1 section 25.7

A common need is a public login action inside an otherwise protected controller. Without the exception, an unauthenticated request can be redirected back to the login page indefinitely. Login, error, and password-reset actions commonly need this attribute. section 24.2.1

Leave the login action public

Apply authorization to the controller, then mark only the login action with [AllowAnonymous]. Other actions remain protected, while unauthenticated users can reach the login endpoint.

Choose the form that matches the endpoint style:

  • Use [AllowAnonymous] on an MVC action, Razor Page, or minimal API handler. section 24.2.1 section 25.6
  • Treat the exception as a deliberate security boundary: it removes authentication requirements, so callers do not need a bearer token. section 25.7

How ASP.NET Core in Action, 3e covers it

How deep it goes
Explains scoped exceptions and redirect-loop prevention, but does not detail authentication middleware internals or policy implementation.
Examples
Demonstrates a protected AccountController with a public Login action and equivalent minimal API configurations.
What it assumes
Assumes familiarity with endpoint authorization and explains the exception from the basics of globally applied Authorize requirements.
What you can do after
Apply it to expose login, error, password-reset, or intentionally public endpoints without requiring authentication.
How it connects
Connects global authorization, Authorize, authentication, minimal APIs, Razor Pages, MVC controllers, and bearer tokens.
Cover of ASP.NET Core in Action, 3e
liveBookmanning.com
Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.