Allow only one action use non secured connection at ASP.NET mvc 4, c#

asp.net-mvc-4, http, https

Solution

As you can see in the source of AuthorizeAttribute it checks the presence of AllowAnonymousAttribute

 bool skipAuthorization = filterContext.ActionDescriptor.IsDefined(typeof(AllowAnonymousAttribute), inherit: true)
                                 || filterContext.ActionDescriptor.ControllerDescriptor.IsDefined(typeof(AllowAnonymousAttribute), inherit: true);

So you can dervive your own attribute from RequireHttps and add the same check so it will look like

 if (!skipAuthorization && !filterContext.HttpContext.Request.IsSecureConnection)
        {

            HandleNonHttpsRequest(filterContext);
        }

and istead of AllowAnonymousAttribute you can add your own AllowHttpAttribute and mark your action with this new AllowHttpAttribute

Problem

At my web application I need to create an action what will be accessible using http non secured connection. All other have to be accessible for https only. I found that I can use `[RequireHttps]` attribute for controller and action. But is there something like `[AllowHttp]` attribute? I do not want to put to all controller's action `[RequireHttps]` attribute. It's easier to put `[RequireHttps]` to Controller and `[AllowHttp]` to one action what can be accessed unsecured. Of course if this attribute is available I mean something like we can do with Authentication. `[Authorize]` to controller and `[AllowAnonymous]` for some actions what can be accessed without authentication.

Original source