Disable class authorize

Question

I would like to know if it is possible to ignore authorization in just one class, because even if I add the [AllowAnonymous] attribute to the class, it needs the JWT token, but this class that will generate the token and it cannot go through the authorization process.

Answer 1

Yes, it is possible to ignore authorization in just one class in ASP.NET Web API. You can achieve this by implementing a custom IAuthorizationFilter attribute and decorating your controller or action method with it. Here's an example of how you can do this:

1. Create a custom AllowAnonymousFilter class that implements IAuthorizationFilter:

    using System.Web.Http.Controllers;
    using System.Web.Http.Filters;
    
    public class AllowAnonymousFilter : IAuthorizationFilter
    {
        public bool AllowMultiple => false;
    
        public Task<HttpResponseMessage> ExecuteAuthorizationFilterAsync(HttpActionContext actionContext, CancellationToken cancellationToken, Func<Task<HttpResponseMessage>> continuation)
        {
            // Add logic to check if the request is for the class that generates the JWT token.
            // If it is, allow the request to proceed without performing authorization.
            if (actionContext.ControllerContext.Controller.GetType() == typeof(TokenController))
            {
                return continuation();
            }
    
            // Otherwise, perform the default authorization checks.
            // You can use the [Authorize] attribute to decorate other controllers or actions
            // that require authorization.
            var user = actionContext.RequestContext.Principal;
            if (user == null || !user.Identity.IsAuthenticated)
            {
                var response = new HttpResponseMessage(HttpStatusCode.Unauthorized)
                {
                    ReasonPhrase = "Authentication failed"
                };
                var tsc = new TaskCompletionSource<HttpResponseMessage>();
                tsc.SetResult(response);
                return tsc.Task;
            }
    
            return continuation();
        }
    }
    ```
    
    
1. Decorate your controller or action method with the **`AllowAnonymousFilter`** attribute:
    
    
```aspx-csharp
    [AllowAnonymousFilter]
    public class TokenController : ApiController
    {
        // Your code for generating the JWT token goes here
    }
    ```
    
    
This will allow requests to the **`TokenController`** to proceed without performing authorization, even if the **`[AllowAnonymous]`** attribute is not working as expected. For all other controllers or actions that require authorization, you can continue to use the **`[Authorize]`** attribute as usual.


----------
**Please, if this answer is helpful, click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please let me know.**