'Authorization in ASP.NET Core. Always 401 Unauthorized for [Authorize] attribute
For the first time I'm creating Authorization in ASP.NET Core. I used tutorial from here TUTORIAL
The problem is when I sending request from postman:
Authorization:Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6I...
to my method in controller decorated with [Authorize] attribute.
I receive 401 Unauthorized
always... I saw comments bellow that tutorial and it seems that some people have similar issue also. I've no idea how I can solve this problem.
Solution 1:[1]
At the request of others here is the answer:
The problem was with the middleware order in Startup.cs
public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
ConfigureAuth(app); // your authorisation configuration
app.UseMvc();
}
Why middleware order is important? If we put app.UseMvc()
first - then the MVC actions would get in the routing and if they see the Authorize attribute they will take control of its handling and that's why we receives 401 Unauthorized error.
I hope it helps someone ;)
Solution 2:[2]
in ASP.NET Core 3.0, i had the same problem, what worked for me was:
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
in StartUp.Configure method.
This doc shows typical ordering of middleware components: https://docs.microsoft.com/en-us/aspnet/core/fundamentals/middleware/?view=aspnetcore-3.0
Solution 3:[3]
If you are using ASP.NET Core 3.0
Check this order
app.UseAuthentication();
app.UseRouting();
//must be below app.UseAuthentication();
If you are using ASP.NET Core < 3.0
Just replace the app.UseRouting();
by app.UseMvc();
i.e:
app.UseAuthentication();
app.UseMvc();
//must be below app.UseAuthentication();
Solution 4:[4]
In my case I was following coreApi,angularClient tutorial, but getting unauthorized error every time also In my case angular application is running under Core Api project.
So then I changed the order like this and it works now
public void Configure(IApplicationBuilder app, IHostingEnvironment env,ILoggerFactory loggerFactory)
{
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
else
{
app.UseExceptionHandler("/Error");
app.UseHsts();
}
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseSpaStaticFiles();
app.UseAuthentication();
app.UseMvc(routes =>
{
routes.MapRoute(
name: "default",
template: "{controller}/{action=Index}/{id?}");
});
app.UseSpa(spa =>
{
// To learn more about options for serving an Angular SPA from ASP.NET Core,
// see https://go.microsoft.com/fwlink/?linkid=864501
spa.Options.SourcePath = "ClientApp";
if (env.IsDevelopment())
{
spa.UseAngularCliServer(npmScript: "start");
}
});
loggerFactory.AddConsole(Configuration.GetSection("Logging"));
loggerFactory.AddDebug();
// global cors policy
app.UseCors(x => x
.AllowAnyOrigin()
.AllowAnyMethod()
.AllowAnyHeader()
.AllowCredentials());
}
Solution 5:[5]
My ConfigureServices and Configure methods (Asp.Net Core 3.1.0) in the Startup class:
public void ConfigureServices(IServiceCollection services)
{
services.AddCors(options =>
{
options.AddPolicy("AllowsAll", builder =>
{
builder.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader();
});
});
services.AddAuthentication(options =>
{
options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
...
});
services.AddControllers();
}
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseAuthentication();
app.UseRouting();
app.UseAuthorization();
app.UseCors(options => options.AllowAnyOrigin());
app.UseEndpoints(endpoints =>
{
endpoints.MapControllers();
});
}
My controller:
[Authorize]
[EnableCors("AllowsAll")]
[Route("[controller]")]
public class MyController : MyController
{
...
}
Solution 6:[6]
for .NET CORE 3.0 or higher user this order in "configure" located in StartUp.cs
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
Solution 7:[7]
In my case i also was using app.MapWhen(code), and app.UseAuthentication(); should be before mapWhen like this
app.UseAuthentication();
app.MapWhen();
app.UseMvc();
Hope this will help.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
Solution | Source |
---|---|
Solution 1 | DiPix |
Solution 2 | |
Solution 3 | Chetha |
Solution 4 | TAHA SULTAN TEMURI |
Solution 5 | |
Solution 6 | Alejandro Garcia |
Solution 7 | So_oP |