ConsumesAttribute on operation (with AllowAnonymousAttribute) returns 401 instead of 415 (due to default/fallback authorization policy)
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 276
Description
### Describe the bug
When applying the ConsumesAttribute on an operation, the documentation specifies that when the provided content-type does not match the list of content-types, a 415 will be returned. (https://docs.microsoft.com/en-us/aspnet/core/web-api/?view=aspnetcore-3.1#define-supported-request-content-types-with-the-consumes-attribute)
However, when specifying an authorization policy as both the default and the fallback, a 401 is returned instead, even though the operation of the controller is marked with [AllowAnonymous].
The following shows a log statement of a failed request:
[Information] Request starting HTTP/1.1 POST http://localhost/documents x-invalid-content-type/plain; charset=utf-8
[Debug] Wildcard detected, all requests with hosts will be allowed.
[Verbose] All hosts are allowed.
[Debug] 1 candidate(s) found for the request path '"/documents"'
[Debug] Request matched endpoint '"415 HTTP Unsupported Media Type"'
[Debug] Static files was skipped as the request already matched an endpoint.
[Debug] Static files was skipped as the request already matched an endpoint.
[Debug] AuthenticationScheme: "Bearer" was not authenticated.
[Information] Authorization failed.
[Information] AuthenticationScheme: "Bearer" was challenged.
[Error] HTTP "POST" "/documents" responded 401 in 157.5365 ms
[Information] Request finished in 178.3029ms 401
I'm assuming that this is due to the fact that the authorization filter is triggered on the "'415 HTTP Unsupported Media Type'" endpoint (due to the default and fallback authorization policy) even though the attribute (ConsumesAttribute) triggering it, is specified on an operation to which anonymous access is allowed.
### To Reproduce
A repository that contains this code, as well as integration tests (using the WebApplicationFactory), can be found here: https://github.com/Meertman/ConsumesIssue
### Exceptions (if any)
No exception, rather a response with status code 401 instead of 415.
### Further technical details
- ASP.NET Core version: 3.1.19
- Include the output of `dotnet --info`
.NET SDK (reflecting any global.json):
Version: 5.0.401
Commit: 4bef5f3dbf
Runtime Environment:
OS Name: Windows
OS Version: 10.0.19043
OS Platform: Windows
RID: win10-x64
Base Path: C:\Program Files\dotnet\sdk\5.0.401\
Host (useful for support):
Version: 5.0.10
Commit: e1825b4928
.NET SDKs installed:
3.1.413 [C:\Program Files\dotnet\sdk]
5.0.104 [C:\Program Files\dotnet\sdk]
5.0.207 [C:\Program Files\dotnet\sdk]
5.0.303 [C:\Program Files\dotnet\sdk]
5.0.401 [C:\Program Files\dotnet\sdk]
.NET runtimes installed:
Microsoft.AspNetCore.All 2.1.30 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.App 2.1.30 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 3.1.18 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 3.1.19 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 5.0.4 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 5.0.9 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 5.0.10 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 2.1.30 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 3.1.18 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 3.1.19 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 5.0.4 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 5.0.9 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 5.0.10 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 3.1.18 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 3.1.19 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 5.0.4 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 5.0.9 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 5.0.10 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
To install additional .NET runtimes or SDKs:
https://aka.ms/dotnet-download
- The IDE (VS / VS Code/ VS4Mac) you're running on, and its version: Visual Studio 2019, version 16.11.3
Contributor guide
Assessment
This issue has not been assessed yet.