---
title: "ASP.Net MVC: Can the AuthorizeAttribute be overriden?"  
description: "ASP.Net MVC: Can the AuthorizeAttribute be overriden?"  
author: "Anonymous User"  
published: 2015-05-21  
updated: 2015-05-21  
canonical: https://www.mindstick.com/forum/23248/asp-dot-net-mvc-can-the-authorizeattribute-be-overriden  
category: "asp.net"  
tags: ["asp.net mvc", "mvc", "authorization"]  
reading_time: 1 minute  

---

# ASP.Net MVC: Can the AuthorizeAttribute be overriden?

As this is an [internal](https://www.mindstick.com/interview/773/describe-the-accessibility-modifier-protected-internal) [application](https://www.mindstick.com/articles/12824/calculator-application-in-android) most of the pages are [private](https://www.mindstick.com/blog/11097/java-access-modifiers-the-public-and-the-private-modifiers) and only viewable to the role "Admin". As I have a base [controller](https://www.mindstick.com/blog/273/passing-values-from-controller-to-view-in-asp-dot-net-mvc) I can do this:

```
[Authorize(Roles="Admin")]public abstract class MyControllerBase : Controller{     ...}
```

I have a [problem](https://yourviews.mindstick.com/view/81399/tackling-the-problem-of-unemployment-during-corona-pandemic) though as some of the [actions](https://www.mindstick.com/forum/156060/what-are-the-actions-performed-by-sql-server) are viewable on a public [website](https://www.mindstick.com/articles/13110/why-copywriting-is-crucial-for-new-website-build) and if I [attribute](https://www.mindstick.com/blog/221/attributes-reflection) them like so:

```
[Authorize(Roles
= "Public")]public class LoginController : MyController{      public ActionResult Index()      {       }}
```

The page fails to load as the user isn't authenticated. It would seem the Role of "Public is being ignored on the inherited class. Does [anyone](https://www.mindstick.com/articles/23207/how-to-find-the-best-fit-job-for-anyone) know if the roles can be overridden by inherited classes?

I am also trying to avoid attributing all the [controllers](https://www.mindstick.com/forum/155773/how-asynchronous-controllers-work-in-asp-dot-net-mvc) with Roles="Admin"

## Replies

### Reply by Anonymous User

Well in the end I think my answer was in the question. Instead of putting the Authorize attribute on my base controller I have derived a new AdminController.

```
[HandleError]public abstract class MyControllerBase : Controller{...} [Authorize(Roles="Admin")]public abstract class AdminControllerBase : MyControllerBase{....}
```

Now any controllers that require authentication can derive from AdminControllerBase while my public controllers can derive from MyControllerBase. OO to the rescue.


---

Original Source: https://www.mindstick.com/forum/23248/asp-dot-net-mvc-can-the-authorizeattribute-be-overriden

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.