title: Rewrite URl according to Attribute
body: <p>We have an ASP.NET Core Web API running on .NET 5. It has got many controllers and routes that are sometimes protected via the <code>Authorize</code> attribute and sometimes they are public.</p>
  <pre class="lang-cs prettyprint-override"><code>[ApiController]
  [Route(&quot;[controller]&quot;)]
  public class UserController : ControllerBase {
  
     [HttpGet(&quot;me&quot;)]
     public IActionResult GetMyPublicInformation()
     {
        // code...
     }
  
     [HttpGet(&quot;me&quot;)]
     [Authorize]
     public IActionResult GetMyPrivateInformation() 
     {
        // code...
     }
  }
  </code></pre>
  <p>Well now I would like to publish these REST routes through different HTTP Routes, depending on the Authorization requirement. For example, the route <code>GetPublicInformation</code> does not require authorization. That route should be available under <code>public/user/me</code>. Whereas the method <code>GetMyPrivateInformation</code> does require authorization and should be published under the route <code>secure/user/me</code>.</p>
  <p><strong>Of coure, I am aware that I can define the route manually</strong> in the <code>HttpGet</code> attribute (i.e. <code>[HttpGet(&quot;public/user/me&quot;)</code>), but - besides that I'm lazy - it would be error prone because we have the information available twice: Once with in the manual route definition (<code>HttpGet</code>) and once in the <code>Authorize</code> attribute. So if someone forgets to change one of the two attributes, we get an inconsistency.</p>
  <p><strong>Question:</strong> What are my options to automate this URL rewriting (I'm thinking of middleware)? Are there any drawbacks you see using this approach? I have been fighting this idea because I don't like extra magic sauce in my codebase. I prefer explicity, that's why I'm going for the manual route naming right now...</p>
  <p>By the way: I have to take this on me because of limitations in Microsoft's MSAL library. I believe I shouldn't have to do this because we host an OpenAPI definition on which routes are and which routes aren't authorized. That should be enough in most cases.</p>