AllowAnonymous on sensitive endpoint (ARCH321)

Key dotnet.security.allow-anonymous-on-sensitive · Severity warning · Category security · CWE CWE-862

Applying [AllowAnonymous] to an action that performs sensitive operations disables authentication and authorization entirely. This can allow unauthorized users to reach resources that should be protected.

Incorrect

[AllowAnonymous]
[HttpPost("admin/delete-user")]
public IActionResult DeleteUser(int id)
{
    _users.Delete(id);
    return Ok();
}

Correct

[Authorize(Roles = "Admin")]
[HttpPost("admin/delete-user")]
public IActionResult DeleteUser(int id)
{
    _users.Delete(id);
    return Ok();
}

Fix

Remove [AllowAnonymous] from sensitive endpoints and apply the appropriate role- or policy-based [Authorize] rule.