dotnet / dotnet/AspNetCore.Docs

Incorrect information about DefaultScheme

Open
#32,640 1 comment 0 reactions 0 assignees View on GitHub
aspnet-core/svc Pri3 security/subsvc Source - Docs.ms
Dominant language
C#
Stars
13.1k
Forks
24.6k
Avg merge
1d 3h
Merged PRs (30d)
97

Description

### Description

[
Documentation has written that "When there is only a single authentication scheme registered, the single authentication scheme: Is automatically used as the DefaultScheme. Eliminates the need to specify the DefaultScheme in AddAuthentication(IServiceCollection) or AddAuthenticationCore(IServiceCollection)."
I has wrote the following code in my application for configure Authentication:
```
services.AddAuthentication()
.AddJwtBearer(configureOptions =>
{

configureOptions.RequireHttpsMetadata = true;
configureOptions.ClaimsIssuer = jwtAppSettingOptions[nameof(JWTOptions.Issuer)];
configureOptions.TokenValidationParameters = tokenValidationParameters;
configureOptions.SaveToken = true;
});
```

And I've configure two policies:
```
services.AddAuthorization(options =>
{
var adminRolePolicy = new AuthorizationPolicyBuilder()
.RequireRole(GlobalConstants.Roles.AdminRoleName)
.RequireAuthenticatedUser()
.RequireActiveUser(services.BuildServiceProvider())
.Build();
var authenticatedUserPolicy = new AuthorizationPolicyBuilder()
.RequireAuthenticatedUser()
.RequireActiveUser(services.BuildServiceProvider())
.Build();
options.AddPolicy(GlobalConstants.Policies.AdminRolePolicy, adminRolePolicy);
options.AddPolicy(GlobalConstants.Policies.AuthenticatedUserPolicy, authenticatedUserPolicy);
});
```

But when I've started to test a behavior I've tried to get access to recourse that was forbidden for me even if I would be Authenticated, so instead of get 403 (Forbidden) corresponding to docs ([link](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/?view=aspnetcore-8.0#forbid)) I've got this:
> http://127.0.0.1:5018/Account/Login?ReturnUrl=%2Fapi%2Fcart%2FGetCustomerCart
> Request Method:
> GET
> Status Code:
> 404 Not Found
That is corresponded to this behavior - "A custom authentication scheme redirecting to a page where the user can request access to the resource.", but I've configured JWT scheme, so I am confused about it. Is it my mistake or is docs incorrect?

I repeat again, according to docs, I have not to configure something else. Because Forbid bevavior that correspond to WT bearer scheme is - returning a 403 result. And I've ADDED this SCHEME when I've written .AddJwtBearer(). and that's confirmed by this text:
Authentication schemes are specified by registering authentication services in Program.cs:
By calling a scheme-specific extension method after a call to AddAuthentication, such as AddJwtBearer or AddCookie. These extension methods use AuthenticationBuilder.AddScheme to register schemes with appropriate settings. Less commonly, by calling AuthenticationBuilder.AddScheme directly.

]

### Page URL

https://learn.microsoft.com/en-us/aspnet/core/security/authentication/?view=aspnetcore-8.0

### Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/authentication/index.md

### Document ID

48e4e204-ea22-c225-0cbc-0d811bdb90ed

### Article author

@mjrousos

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.