{"record":{"id":"32ee0697070932f7","repo":"reactiveui/refit","slug":"only-one-parameter-can-be-an-authorize-parameter","errorCode":null,"errorMessage":"Only one parameter can be an Authorize parameter","messagePattern":"Only one parameter can be an Authorize parameter","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Refit.Reflection/RestMethodInfoInternal.AttributeReading.cs","lineNumber":240,"sourceCode":"    /// <param name=\"sets\">The classified attribute set for each parameter.</param>\n    /// <returns>The authorization parameter information, or null when there is no authorize parameter.</returns>\n    /// <exception cref=\"ArgumentException\">More than one parameter carries <see cref=\"AuthorizeAttribute\"/>.</exception>\n    internal static Tuple<string, int>? FindAuthorizationParameter(ParameterAttributeSet[] sets)\n    {\n        AuthorizeAttribute? authorizeAttribute = null;\n        var authorizeIndex = -1;\n\n        for (var i = 0; i < sets.Length; i++)\n        {\n            var attribute = sets[i].Authorize;\n            if (attribute is null)\n            {\n                continue;\n            }\n\n            if (authorizeAttribute is not null)\n            {\n                throw new ArgumentException(\"Only one parameter can be an Authorize parameter\");\n            }\n\n            authorizeAttribute = attribute;\n            authorizeIndex = i;\n        }\n\n        return authorizeAttribute is null\n            ? null\n            : Tuple.Create(authorizeAttribute.Scheme, authorizeIndex);\n    }\n}\n","sourceCodeStart":222,"sourceCodeEnd":252,"githubUrl":"https://github.com/reactiveui/refit/blob/b455f65ecc4c97d092317e349cb775f9cfc6bcdf/src/Refit.Reflection/RestMethodInfoInternal.AttributeReading.cs#L222-L252","documentation":"A method may declare at most one [Authorize]-style parameter (the authorization scheme carrier). The loop records the first authorize attribute and throws if a second authorize parameter is found. Multiple authorize parameters would produce conflicting scheme selection.","triggerScenarios":"Two parameters on the same method both carry the Authorize attribute (auth scheme binding).","commonSituations":"Adding a second auth parameter during a security refactor; mixing token + API-key auth as two Authorize params; copy-paste of an auth param.","solutions":["Keep a single Authorize parameter per method and express additional credentials via [Header] or [Authorization] differently.","If two schemes are needed, resolve which one is authoritative and remove the second Authorize binding."],"exampleFix":"// before\n[Get(\"/me\")] Task MeAsync([Authorize(\"Bearer\")] string jwt,\n                          [Authorize(\"Basic\")] string basic);\n\n// after\n[Get(\"/me\")] Task MeAsync([Authorize(\"Bearer\")] string jwt);","handlingStrategy":"validation","validationCode":"static void AssertSingleAuthorize(MethodInfo m) {\n    var count = m.GetParameters().Count(p => p.GetCustomAttribute<AuthorizeAttribute>() is not null);\n    if (count > 1) throw new InvalidOperationException(\"Multiple Authorize params on \" + m.Name);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep one Authorize parameter per method.","Express additional credentials via headers, not a second Authorize param.","Review auth bindings during security review."],"tags":["refit","auth","attributes","design-time"],"backgroundTag":null,"analyzedSha":"b455f65ecc4c97d092317e349cb775f9cfc6bcdf","analyzedAt":"2026-08-13T21:20:57.878Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}