AllowAnonymous attribute at action level is ignored in AppendAuthorizeToSummaryOperationFilter

Hello,

There’s the following code, which protects the controller with specific scope, but allows one of the actions to be accessed without any authorization:

    [Authorize("scope.read")]
    public class ItemsController : Controller
    {
        [AllowAnonymous]
        public async Task<IActionResult> Get()
        {
          // do stuff ...
        }
    }

Anyhow, using AppendAuthorizeToSummaryOperationFilter filter, the following is added to GET /Items description: (Auth policies: scope.read).

This does not seem to be a correct behavior, as the action can be accessed with no authorization, meaning the Auth policies should not be displayed either.

[mattfrear]

OK. I’ve fixed it in both. https://www.nuget.org/packages/Swashbuckle.AspNetCore.Examples/2.8.1 https://www.nuget.org/packages/Swashbuckle.Examples/3.9.1

[mattfrear]

OK this sounds like a bug so I’ll investigate it when I get a chance.