dotnet / dotnet/AspNetCore.Docs
Incorrect information about DefaultScheme
- Dominant language
- C#
- Stars
- 13.1k
- Forks
- 24.6k
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 97
Description
### Description
[
Documentation has written that "When there is only a single authentication scheme registered, the single authentication scheme: Is automatically used as the DefaultScheme. Eliminates the need to specify the DefaultScheme in AddAuthentication(IServiceCollection) or AddAuthenticationCore(IServiceCollection)."
I has wrote the following code in my application for configure Authentication:
```
services.AddAuthentication()
.AddJwtBearer(configureOptions =>
{
configureOptions.RequireHttpsMetadata = true;
configureOptions.ClaimsIssuer = jwtAppSettingOptions[nameof(JWTOptions.Issuer)];
configureOptions.TokenValidationParameters = tokenValidationParameters;
configureOptions.SaveToken = true;
});
```
And I've configure two policies:
```
services.AddAuthorization(options =>
{
var adminRolePolicy = new AuthorizationPolicyBuilder()
.RequireRole(GlobalConstants.Roles.AdminRoleName)
.RequireAuthenticatedUser()
.RequireActiveUser(services.BuildServiceProvider())
.Build();
var authenticatedUserPolicy = new AuthorizationPolicyBuilder()
.RequireAuthenticatedUser()
.RequireActiveUser(services.BuildServiceProvider())
.Build();
options.AddPolicy(GlobalConstants.Policies.AdminRolePolicy, adminRolePolicy);
options.AddPolicy(GlobalConstants.Policies.AuthenticatedUserPolicy, authenticatedUserPolicy);
});
```
But when I've started to test a behavior I've tried to get access to recourse that was forbidden for me even if I would be Authenticated, so instead of get 403 (Forbidden) corresponding to docs ([link](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/?view=aspnetcore-8.0#forbid)) I've got this:
> http://127.0.0.1:5018/Account/Login?ReturnUrl=%2Fapi%2Fcart%2FGetCustomerCart
> Request Method:
> GET
> Status Code:
> 404 Not Found
That is corresponded to this behavior - "A custom authentication scheme redirecting to a page where the user can request access to the resource.", but I've configured JWT scheme, so I am confused about it. Is it my mistake or is docs incorrect?
I repeat again, according to docs, I have not to configure something else. Because Forbid bevavior that correspond to WT bearer scheme is - returning a 403 result. And I've ADDED this SCHEME when I've written .AddJwtBearer(). and that's confirmed by this text:
Authentication schemes are specified by registering authentication services in Program.cs:
By calling a scheme-specific extension method after a call to AddAuthentication, such as AddJwtBearer or AddCookie. These extension methods use AuthenticationBuilder.AddScheme to register schemes with appropriate settings. Less commonly, by calling AuthenticationBuilder.AddScheme directly.
]
### Page URL
https://learn.microsoft.com/en-us/aspnet/core/security/authentication/?view=aspnetcore-8.0
### Content source URL
https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/authentication/index.md
### Document ID
48e4e204-ea22-c225-0cbc-0d811bdb90ed
### Article author
@mjrousos
Contributor guide
Assessment
This issue has not been assessed yet.