{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/1577","repository_url":"https://api.github.com/repos/aspnet/Security","labels_url":"https://api.github.com/repos/aspnet/Security/issues/1577/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/1577/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/1577/events","html_url":"https://github.com/aspnet/Security/issues/1577","id":283598568,"node_id":"MDU6SXNzdWUyODM1OTg1Njg=","number":1577,"title":"[Authorize(AuthenticationSchemes = Custom)] on Controller takes precedence over [AllowAnonymous] on Action","user":{"login":"bogdan-s","id":5063354,"node_id":"MDQ6VXNlcjUwNjMzNTQ=","avatar_url":"https://avatars2.githubusercontent.com/u/5063354?v=4","gravatar_id":"","url":"https://api.github.com/users/bogdan-s","html_url":"https://github.com/bogdan-s","followers_url":"https://api.github.com/users/bogdan-s/followers","following_url":"https://api.github.com/users/bogdan-s/following{/other_user}","gists_url":"https://api.github.com/users/bogdan-s/gists{/gist_id}","starred_url":"https://api.github.com/users/bogdan-s/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bogdan-s/subscriptions","organizations_url":"https://api.github.com/users/bogdan-s/orgs","repos_url":"https://api.github.com/users/bogdan-s/repos","events_url":"https://api.github.com/users/bogdan-s/events{/privacy}","received_events_url":"https://api.github.com/users/bogdan-s/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":11,"created_at":"2017-12-20T15:23:37Z","updated_at":"2018-11-13T17:50:24Z","closed_at":"2018-11-08T22:20:35Z","author_association":"NONE","body":"I have created a new custom AuthenticationHandler. On the controller I have put the attribute Authorize with this new Authentication Scheme. On the action I have put AllowAnonymous. When I call the action, the AuthenticationHandler.HandleAuthenticateAsync gets called first, it will fail with a AuthenticateResult.Fail result, but then the action will get called. I would expect the AllowAnonymous to override the Authorize of the controller.   \r\n\r\n    [Authorize(AuthenticationSchemes = TokenAuthenticationDefaults.AuthenticationScheme)]    \r\n    public class ApiController : Controller\r\n    {\r\n\r\n    [AllowAnonymous]\r\n    [Route(\"api/login\")]\r\n    [HttpGet]\r\n    public async Task<IActionResult> Login(LoginModel model)       \r\n    {}\r\n\r\n    }      "},"comment":{"url":"https://api.github.com/repos/aspnet/Security/issues/comments/438370025","html_url":"https://github.com/aspnet/Security/issues/1577#issuecomment-438370025","issue_url":"https://api.github.com/repos/aspnet/Security/issues/1577","id":438370025,"node_id":"MDEyOklzc3VlQ29tbWVudDQzODM3MDAyNQ==","user":{"login":"swlasse","id":237092,"node_id":"MDQ6VXNlcjIzNzA5Mg==","avatar_url":"https://avatars2.githubusercontent.com/u/237092?v=4","gravatar_id":"","url":"https://api.github.com/users/swlasse","html_url":"https://github.com/swlasse","followers_url":"https://api.github.com/users/swlasse/followers","following_url":"https://api.github.com/users/swlasse/following{/other_user}","gists_url":"https://api.github.com/users/swlasse/gists{/gist_id}","starred_url":"https://api.github.com/users/swlasse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/swlasse/subscriptions","organizations_url":"https://api.github.com/users/swlasse/orgs","repos_url":"https://api.github.com/users/swlasse/repos","events_url":"https://api.github.com/users/swlasse/events{/privacy}","received_events_url":"https://api.github.com/users/swlasse/received_events","type":"User","site_admin":false},"created_at":"2018-11-13T17:50:24Z","updated_at":"2018-11-13T17:50:24Z","author_association":"NONE","body":"I might be missing something here, but I am curious to know what is the answer to what @Tratcher points out?\r\n\r\n> AllowAnonymous has always trumped, but what they bring up here is that Authorize runs anyways and then gets discarded. Why does Authorize run at all?\r\n\r\nI see there is pull request referenced, but I am not entirely sure how that relates to this?"}}
{"actor":{"display_login":"swlasse"}}