AuthorizeFilter bypass? about webessentials.aspnetcore.serviceworker

[StefanoChiodino]

I went around this by using

        public static void ConfigureMvc(this IServiceCollection services)
        {
            // if request path is /serviceworker allow.
            var policyBuilder = new AuthorizationPolicyBuilder()
                .AddRequirements(new WhitelistDenyAnonymousAuthorizationRequirement("/serviceworker"));
            var policy = policyBuilder
                .Build();
            services.AddMvc(options => options.Filters.Add(new AuthorizeFilter(policy)))
                .SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
        }

        private class WhitelistDenyAnonymousAuthorizationRequirement : DenyAnonymousAuthorizationRequirement
        {
            private readonly string[] _whitelistedPaths;

            public WhitelistDenyAnonymousAuthorizationRequirement(params string[] whitelistedPaths)
            {
                _whitelistedPaths = whitelistedPaths;
            }

            protected override Task HandleRequirementAsync(AuthorizationHandlerContext context,
                DenyAnonymousAuthorizationRequirement requirement)
            {
                if (context.Resource is AuthorizationFilterContext authorizationFilterContext)
                {
                    var path = authorizationFilterContext.HttpContext.Request.Path;
                    var isPathWhitelisted = _whitelistedPaths
                        .Any(x => x.Equals(path, StringComparison.OrdinalIgnoreCase));
                    if (isPathWhitelisted)
                    {
                        context.Succeed(requirement);
                        return Task.CompletedTask;
                    }
                }

                return base.HandleRequirementAsync(context, requirement);
            }
        }

It would be useful to mark this candle as AllowAnonymous to not need this.