Some controllers unauthorized

[dylan.riden]

Hi,

I have been playing around with a test project and noticed that some of the CSV/Excel export controllers do not have authorize tags on them.

Testing this further, I deleted all cookies and did not log in. I was able to call the API directly and actually download.

I am using AzureAd authentication, with a Postgres datasource.

Is there anything I may be missing here

Thanks!

[enchev]

Export API security

Hi @zarroc, You can secure the export controller by adding a partial class for it and decorating it with the [Authorize] attribute. Regards, Atanas Korchev, the Radzen team

[dylan.riden]

Sorry I didn't see this one, is there any plans to make this a default when security is added?

Thanks

[enchev]

We don't have plans to mark this controller by default with Authorize attribute - it will be serious braking change for all existing applications.