Check AllowAnonymousAttribute in Web API

asp.net-web-api, authentication, c#, security

Solution

I found. I can use GetCustomAttributes method. For example (from AuthorizeAttribute implementation):

private static bool SkipAuthorization(HttpActionContext actionContext)
{
  if (!Enumerable.Any<AllowAnonymousAttribute>((IEnumerable<AllowAnonymousAttribute>) actionContext.ActionDescriptor.GetCustomAttributes<AllowAnonymousAttribute>()))
    return Enumerable.Any<AllowAnonymousAttribute>((IEnumerable<AllowAnonymousAttribute>) actionContext.ControllerContext.ControllerDescriptor.GetCustomAttributes<AllowAnonymousAttribute>());
  else
    return true;
}

Problem

System.Web.Mvc.ActionDescriptor has method IsDefined which helps to determine whether one or more instances of the specified attribute type are defined for this member. System.Web.Http.Controllers.HttpActionDescriptor does not have this method. How can I check AllowAnonymousAttribute using HttpActionDescriptor?

Original source