Apply [Authorize] attribute implicitly to all Web API controllers

Question

My application is setup where all requests except login must be 'authorized' using the authorization attribute in Web API. E.g. ``` [Authorize] [HttpGet, Route("api/account/profile")] public ApplicationUser Profile() { return userModel; } ``` and only the login needs to not authorize since thats where you get the token ;) ``` [AllowAnonymous] [HttpPost, Route("api/account/login")] public async Task<IHttpActionResult> Login(LoginViewModel model) { .... } ``` instead of having to add the `[Authorize]` attribute to ALL my routes, is there a way to set it globally?

Accepted Answer

You have two options

Controller level by decorating your controller with authorize attribute.

```
[Authorize]
[RoutePrefix("api/account")]
public class AccountController : ApiController
{
```

You can also set it global level to all routes, in `Register` method of WebApiConfig.cs file

```
 config.Filters.Add(new AuthorizeAttribute());
```

Apply [Authorize] attribute implicitly to all Web API controllers

Solution

Problem