In Asp Net Core, Do I have to put the Attribute of [Authorize] for both Get and Post Method?

user_1929582 0
Viewed 220

In the controller, normally we have a Get and a Post methods for example:

[HttpGet]
[Authorize(Policy = "AdminMs")]
public async Task<IActionResult> MSCreate()
{
}

[HttpPost]
[ValidateAntiForgeryToken]
[Authorize(Policy = "AdminMs")]
public async Task<IActionResult> MSCreate(empolyee)
{
}

Do I have to set the Authorize Attribute for both methods or only for HttpGet?

asp.net-core security
1 Answers

If you need only authorized access to any of the end points, you have to use [Authorize] on whichever method that corresponds to that endpoint. Having it on one method does not mean that it will restrict the other method even if they have similar method names.

user_109442070
Related