All rules

P016 SecurityExemptions

Applies to
Pull requests, through the GitHub App
Severity
Warning (fails the check under fail-on-warnings)
Summary
A change exempts an endpoint from antiforgery or authorization.
Flags
Added [IgnoreAntiforgeryToken], [AllowAnonymous], .DisableAntiforgery() and .AllowAnonymous() in .cs, .cshtml and .razor files outside test files. Comment lines and string literals are skipped, and so is an exemption a removed line in the same hunk already carried (an edited line). Generated files (<auto-generated in the first 10 lines) are skipped.

Before

app.MapPost("/subscribe", Subscribe).DisableAntiforgery();

After

app.MapPost("/subscribe", Subscribe);

Fix