What does [Authorize(Users = “*”)] mean in asp.net mvc

Question

What does [Authorize(Users = \"*\")] mean in asp.net mvc.? Also please explain [Authorize(Users = \"\")] and [Authorize(Users = \"?\")].

Answer 1

To authorize all users, just omit using the [Authorize] attribute alltogether. To authorize authenticated users, use the [Authorize] attribute. To authorize specific roles or users, that is when you'll have [Authorize (Users = "someuser")] or [Authorize (Roles = "somerole")].

Answer 2

Looking at the documentation for the attribute it doesn't look like you can use it that way. By default the AuthorizeAttribute only allows access to authenticated and authorised users so passing * (all) or ? (guest) doesn't make sense.
The Users property is used to further restrict the list of authenticated users who can access the Action method along with the Roles property which can also be used to further filter any authenticated access.

Answer 3

I think the second post is correct, in [Authorize(Users = " * ")] the " * " part doesn't make any sense (in the web.config it does but that is something completely different).