Swashbuckle ignores the "AllowAnonymous" attribute of controller operations

If i have controller operations with the “AllowAnonymous” attribute (see example below):

[AllowAnonymous]
[HttpGet]
public Response ExampleFunction(string exampleInput)
{
   ...
  return retVal
}

The operation does still have the auth in the generated Swagger documentation (lock is shown & the auth header will be sent with every request).

I expect, that Swashbuckle does respect this attribute and removes the auth of the endpoint / operation.

Version of Swashbuckle.AspNetCore: 5.1.0 Version of .NET Core: 3.1.102

[tiwalter]

Thanks, you’re right!

This implementation works for me:

public class BasicAuthOperationsFilter : IOperationFilter
{
    public void Apply(OpenApiOperation operation, OperationFilterContext context)
    {
        var noAuthRequired = context.ApiDescription.CustomAttributes().Any(attr => attr.GetType() == typeof(AllowAnonymousAttribute));

        if (noAuthRequired) return;

        operation.Security = new List<OpenApiSecurityRequirement>
        {
            new OpenApiSecurityRequirement
            {
                {
                    new OpenApiSecurityScheme
                    {
                        Reference = new OpenApiReference
                        {
                            Type = ReferenceType.SecurityScheme,
                            Id = "basic"
                        }
                    },
                    new List<string>()
                }
            }
        };
    }
}

The only thing you have to do is to filter operations with the “AllowAnonymous” attribute. The operation.Security property will be adjusted for them.

[domaindrivendev]

Yes. When you use the AddSecurityRequirement method you’re adding a “global” requirement (i.e. applicable to all operations). If you want to add security requirements at the operation level, then you’ll need to create a custom Operation Filter that inspects your action metadata for the presence of authorization attributes and then sets the corresponding Operation.Security property accordingly.

The readme has an example that does this for an OAuth security scheme. If you read through that section carefully then you should be able to adjust the example for the “basic” schema in your case. If anything, it should be much simpler than the OAuth one.