Allow action method to be accessed only by anonymous user in Asp.Net Core MVC

Overview

In a typical ASP.NET Core application, you globally restrict access to authenticated users. The built-in [AllowAnonymous] attribute allows specific actions for anonymous users. However, the opposite scenario—restricting an action to only anonymous users—requires a custom filter.

This tutorial demonstrates how to create a custom AnonymousOnlyFilter attribute to prevent authenticated users from accessing specific pages or actions.

Creating the AnonymousOnlyFilter

First, create a class file AnonymousOnlyFilter.cs

1
public class AnonymousOnlyFilter : ActionFilterAttribute
2
{
3
    public override void OnActionExecuting(ActionExecutingContext context)
4
    {
5
        if (context.HttpContext.User.Identity.IsAuthenticated)
6
        {
7
            context.Result = new RedirectToActionResult("Index", "Home", "");
8
        }
9
    }
10
}

How It Works

This custom filter:

1. Derives from ActionFilterAttribute — This base class provides the OnActionExecuting hook, which executes before any controller action runs
2. Checks user authentication — context.HttpContext.User.Identity.IsAuthenticated returns true if the user is logged in
3. Redirects authenticated users — If the user is authenticated, they’re redirected to the home page (you can change this redirect target)

Applying the Filter

Use the [AnonymousOnlyFilter] attribute on specific actions or the entire controller:

Example: On Individual Actions

1
public class HomeController : Controller
2
{
3
    // This action is accessible to everyone
4
    public IActionResult Index()
5
    {
6
        return View();
7
    }
8

9
    // Only anonymous users can access this
10
    [AnonymousOnlyFilter]
11
    public IActionResult Login()
12
    {
13
        return View();
14
    }
15

16
    // Only anonymous users can access this
17
    [AnonymousOnlyFilter]
18
    public IActionResult Register()
19
    {
20
        return View();
21
    }
22

23
    // Regular authenticated-only action
24
    [Authorize]
25
    public IActionResult Dashboard()
26
    {
27
        return View();
28
    }
29
}

Example: On Entire Controller

1
[AnonymousOnlyFilter]
2
public class AuthController : Controller
3
{
4
    // All actions in this controller are anonymous-only
5
    public IActionResult Login() => View();
6
    public IActionResult Register() => View();
7
    public IActionResult ForgotPassword() => View();
8
}

Summary

With this custom filter, you can easily protect anonymous-only pages from being accessed by authenticated users. It’s a simple but powerful way to enforce your application’s access control logic beyond the standard [Authorize] and [AllowAnonymous] attributes.