Is it possible to add exceptions for which controller actions the default authorization policy should not be used?

Question

If we want our ASP.NET Core application to use the default authorization policy on all actions, except X actions, how would we do that, other than defining separate policies/using an Authorization Filter that will filter them based on the request's URI?

To add the default policy to all our endpoints, we can do the following in ConfigureServices method:

app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllers()
                .RequireAuthorization();
            });

Answer 1

You can use [AllowAnonymous] above the X actions where you do not want authorization