AllowAnonymous attribute not working

Hi MikeMP​,

I just saw your post and I think I can help. 

First thing I would do is to apply authentication to your program by adding 

app.UseAuthentication()

right before authorization so it becomes

app.UseRouting();

app.UseAuthentication(); 
app.UseAuthorization(); 

app.UseSession();

Without UseAuthentication(), Identity cannot establish the user principal correctly.

However, that alone may not be the root cause, [AllowAnonymous] should override authorization requirements. If requests are still being redirected to login, I guess there is a global authorization policy somewhere in your code. 

If you have a fallback policy, then [AllowAnonymous] should still work. If it doesn't, there may be another filter or middleware forcing authentication.

One thing you can try, create a completely anonymous controller, like:

[AllowAnonymous] public class TestController : Controller 
{ 
  public IActionResult Public() 
  { 
    return Content("Public page"); 
  }
}

Then browse to:

/Test/Public

If that still redirects to:

/Identity/Account/Login

then the problem is almost certainly a global authorization policy, custom middleware, or a base controller containing [Authorize].

Hope this helps, 

Kindly reply if it did or did not help, and how you have solved the problem if you already did.