title: Preventing AllowAnonymous
body: <p>I have a base controller which is globally marked as [Authorize]. Is there a way to prevent Controllers which inherit it from overriding the authorization requirement by simply adding the [AllowAnonymous] attribute?</p>
  
  <p>Here is my exact scenario: I have three base controllers: one is for anonymous users, and two are for logged in users, both of which are globally decorated with [Authorize]. Each new controller that is created inherits from one of the base three, depending on which functionality is needed. One of the [Authorize] controllers contains "highly secure" functionality which absolutely should not be run by anonymous users. A developer inheriting from this "secure" base controller accidentally decorated some methods with [AllowAnonymous] which enabled anonymous users to potentially access the "secure" functionality in the base controller. It was caught in testing but I thought it would be a good idea to prevent that type of mistake, and I'm wondering if there is a simple way to do that. For now, I have taken all of the code inside of the secure base controller and wrapped it in blocks of:</p>
  
  <pre><code>if (Request.IsAuthenticated)
  {
      // do stuff
  }
  else
  {
      // redirect to login page, basically simulating what [Authorize] does
  }
  </code></pre>
  
  <p>The above accomplishes what I want, however it kind of defeats the purpose of the global [Authorize] decoration in the first place. I'm envisioning something along the lines of:</p>
  
  <pre><code>[Authorize(AllowAnonymousOverride=false)] // this doesn't exist, but might be helpful
  </code></pre>
  
  <p>Is there a better way to accomplish this functionality?</p>