Abp AllowAnonymous for child methods

Question

I'm using Abp framework with MVC. I have an anonymous method that calls a bunch of methods inside it which all of the them have [Authorize] attribute. I want to call this parent method and all of the inside methods as anonymous without setting all the inside methods as anonymous. Currently I'm getting an error about not being authorized for calling those sub methods. How can I achieve this? Thanks

For example:

[Authorize]
void A(){}

[Authorize]
void B(){}

[AbpAllowAnonymous]
void C(){
//call these two
A();
B();
}

For example:

[Authorize]
void A(){}

[Authorize]
void B(){}

[AbpAllowAnonymous]
void C(){
//call these two
A();
B();
}

user_7149235 · Answer

You can distribute those methods into shared private methods. With this pattern, you can keep the authorization requirements as they are but share functionality. Sample alternative pattern:

[Authorize]
void A(){ _a(); }

[Authorize]
void B(){ _b(); }

[AbpAllowAnonymous]
void C(){
  //call these two
  _a();
  _b();
}
// shared private methods
private void _a() {}
private void _b() {}

user_10477283 · Answer

Maybe you can use the OverrideAuthorizationAttribute on your action.

Represents a filter attribute that overrides authorization filters defined at a higher level. (https://docs.microsoft.com/en-us/previous-versions/aspnet/dn308862(v=vs.118)

[Authorize]
void A(){}

[Authorize]
void B(){}

[OverrideAuthorization]
[AllowAnonymous]
void C(){
//call these two
A();
B();
}

Abp AllowAnonymous for child methods

2 Answers