fix: enforce authorization on login refresh and logout endpoints

ChaosEngine · ChaosEngine · commit e680d490c84b · 2026-03-12T20:34:01.000+01:00
diff --git a/src/IdentityManager2/Api/Controllers/PageController.cs b/src/IdentityManager2/Api/Controllers/PageController.cs
@@ -12,6 +12,7 @@ namespace IdentityManager2.Api.Controllers
 {
     [SecurityHeaders]
     [ResponseCache(NoStore = true, Location = ResponseCacheLocation.None)]
+    [Authorize(IdentityManagerConstants.IdMgrAuthPolicy)]
     public class PageController : Controller
     {
         private readonly IdentityManagerOptions config;
@@ -56,7 +57,6 @@ public async Task<IActionResult> Login()
         }
 
         [HttpGet]
-        [AllowAnonymous]
         [Route("api/login/refresh")]
         public async Task<IActionResult> Refresh()
         {
@@ -71,7 +71,6 @@ public async Task<IActionResult> Refresh()
         }
 
         [HttpGet]
-        [AllowAnonymous]
         [Route("api/logout", Name = IdentityManagerConstants.RouteNames.Logout)]
         public async Task<IActionResult> Logout()
         {

Original file line number	Diff line number	Diff line change
`@@ -12,6 +12,7 @@ namespace IdentityManager2.Api.Controllers`
`12`	`12`	`{`
`13`	`13`	`[SecurityHeaders]`
`14`	`14`	`[ResponseCache(NoStore = true, Location = ResponseCacheLocation.None)]`
	`15`	`+ [Authorize(IdentityManagerConstants.IdMgrAuthPolicy)]`
`15`	`16`	`public class PageController : Controller`
`16`	`17`	`{`
`17`	`18`	`private readonly IdentityManagerOptions config;`
`@@ -56,7 +57,6 @@ public async Task<IActionResult> Login()`
`56`	`57`	`}`
`57`	`58`
`58`	`59`	`[HttpGet]`
`59`		`- [AllowAnonymous]`
`60`	`60`	`[Route("api/login/refresh")]`
`61`	`61`	`public async Task<IActionResult> Refresh()`
`62`	`62`	`{`
`@@ -71,7 +71,6 @@ public async Task<IActionResult> Refresh()`
`71`	`71`	`}`
`72`	`72`
`73`	`73`	`[HttpGet]`
`74`		`- [AllowAnonymous]`
`75`	`74`	`[Route("api/logout", Name = IdentityManagerConstants.RouteNames.Logout)]`
`76`	`75`	`public async Task<IActionResult> Logout()`
`77`	`76`	`{`