I doesn't think there is a way to make it optional. I would remove the attribute and instead use User.Identity.IsAuthenticated to check whether the request were send from an authenticated user and then access the user id.