Unauthorized access is security hot spot. Within .NET both Minimal API and (API) controllers allow an option that grands anonymous access. As this precedes authorize instructions the latter will not be taken into account, what most likely is a (security) bug. Hence the rule proposal.
Non-compliant
class Controller : ControllerBase
{
[AllowAnonymous]
[Authorize("math-wizard")] // Noncompliant {{Either chose AllowAnonymous or Authorize, but not both }}
public int TheAnswer() => 42;
}
void Main()
{
app.MapGet("/answer", () => 42)
.AllowAnonymous()
.RequireAuthorization(); // Noncompliant {{Either chose AllowAnonymous() or RequireAuthorization() but not both}}
}
Compliant
class Controller : ControllerBase
{
[AllowAnonymous]
public int TheAnswer() => 42;
}
void Main()
{
app.MapGet("/answer", () => 42)
.AllowAnonymous();
}
or
class Controller : ControllerBase
{
[Authorize("math-wizard")]
public int TheAnswer() => 42;
}
void Main()
{
app.MapGet("/answer", () => 42)
.RequireAuthorization();
}