Question

I’ve tagged my controller with an authority annotation but would like to exempt one of the methods… can that be done? how?

[Authorize(Roles="Admin")]
public class ProductController : Controller
{
    [DEAUTHORIZE]
    public ActionResult Start(int it)
    { ... }

Answer 1

No, this can’t be done. The standard way to achieve this is to simply move the Start action out in a separate controller. Another possibility consists into building a custom IFilterProvider which will apply the authorization attribute conditionally instead of baking it manually into the ProductController. For example NInject uses this and provides a pretty fluent syntax into configuring action filters. You can conditionally apply them based on the current context.