Question

I would like to use [Authorize] for every action in my admin controller except the Login action.

[Authorize (Roles = 'Administrator')] public class AdminController : Controller {     // what can I place here to disable authorize?     public ActionResult Login()     {         return View();     } } 

Answer 1

I don’t think you can do this with the standard Authorize attribute, but you could derive your own attribute from AuthorizeAttribute that takes a list of actions to allow and allows access to just those actions. You can look at the source for the AuthorizeAttribute at http://www.codeplex.com for ideas on how to do this. If you did, it might look like:

[AdminAuthorize (Roles = 'Administrator', Exempt = 'Login, Logout') ] public class AdminController : Controller {     public ActionResult Login()     {         return View();     }      public ActionResult Login()     {         return View();     }      ... other, restricted actions ... } 

EDIT: FYI, I eventually ran across a need to do something similar on my own and I went a different direction. I created a default authorization filter provider and apply a global authorize filter. The authorization filter provider uses reflection to check if an action or controller has a specific authorize attribute applied and, if so, defers to it. Otherwise, it applies a default authorization filter. This is coupled with a PublicAttribute derived from AuthorizeAttribute that allows public access. Now, I get default secured access, but can grant public access via [Public] applied to an action or controller. More specific authorization can also be applied as necessary. See my blog at http://farm-fresh-code.blogspot.com/2011/04/default-authorization-filter-provider.html