Clarify that [AllowAnonymous] allows authentication, not disables it

[Copilot]

The ASP0026 documentation incorrectly implied that [AllowAnonymous] disables authorization entirely. In reality, endpoints with [AllowAnonymous] still authenticate credentials when provided—they simply don't require authentication.

Changes

• Added NOTE clarifying authentication behavior: credentials are authenticated when sent, anonymous access occurs only when no credentials provided
• Expanded "Rule description" to explicitly state both authenticated and anonymous code paths
• Updated code comments to reflect that AuthenticationSchemes remains useful for optional authentication scenarios

Metadata

• Updated ms.date to 11/06/2025
• Added ai-usage: ai-assisted
• Alphabetized frontmatter per repository guidelines

Applied changes to both aspnetcore/diagnostics/asp0026.md and the included snippet in aspnetcore/release-notes/aspnetcore-9/includes/asp0026.md for consistency.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>ASP0026 is misleading and needs further clarity</issue_title>
<issue_description>### Description

The warning makes it sound like the AllowAnonymous disables authorization all together. But it does not. If a method has both [AllowAnonymous] and [Authorize()] attributes applied, and the client sends credentials to the endpoint, the endpoint will authenticate the credentials and log the user in. Only if there are no credentials will it run as anonymous.

Page URL

https://learn.microsoft.com/en-us/aspnet/core/diagnostics/asp0026?view=aspnetcore-9.0

Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/diagnostics/asp0026.md

Document ID

d2c79b3f-f7d7-d5db-c488-57feda9e17a6

Platform Id

2ca4a99f-2dd5-1fbd-4be8-4e55e6c51203

Article author

@tdykstra

Metadata

• ID: d2c79b3f-f7d7-d5db-c488-57feda9e17a6
• PlatformId: 2ca4a99f-2dd5-1fbd-4be8-4e55e6c51203
• Service: aspnet-core

Related Issues

---

Associated WorkItem - 506179</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes ASP0026 is misleading and needs further clarity #35643

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

---

Internal previews

📄 File	🔗 Preview link
aspnetcore/diagnostics/asp0026.md	aspnetcore/diagnostics/asp0026

[Copilot]

Pull Request Overview

This PR enhances the documentation for ASP0026 analyzer by clarifying how the [AllowAnonymous] attribute behaves with authentication credentials. The changes address a common misconception that [AllowAnonymous] completely disables authentication, when it actually only makes authentication optional.

Key changes:

1. Added a NOTE section explaining that [AllowAnonymous] still authenticates credentials when provided
2. Expanded the rule description to clarify the security implications of the override behavior
3. Updated inline comments to better explain the use case for combining [Authorize] with [AllowAnonymous]

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
aspnetcore/release-notes/aspnetcore-9/includes/asp0026.md	Added NOTE about [AllowAnonymous] authentication behavior and updated inline comments for clarity
aspnetcore/diagnostics/asp0026.md	Added metadata, NOTE section, expanded rule description with security implications, and updated inline comments

[wadepickett]

Looks great!