[Authorize] overridden by a farther [AllowAnonymous] (ASP0026)

Key dotnet.security.authorize-overridden-by-allowanonymous · Severity error · Category security · CWE CWE-862

ASP.NET Core analyzer ASP0026. Flags an [Authorize] that looks like it protects an action but does not, because an [AllowAnonymous] further away (on the controller or a base class) wins over it. The action is open to anyone.

Incorrect

[AllowAnonymous]
public class ReportsController : ControllerBase
{
    [Authorize(Roles = "Admin")]
    [HttpDelete("{id}")]
    public IActionResult Delete(int id) => Ok();
}

Correct

[Authorize]
public class ReportsController : ControllerBase
{
    [Authorize(Roles = "Admin")]
    [HttpDelete("{id}")]
    public IActionResult Delete(int id) => Ok();
}