Authorization/authentication errors thrown before feature flag is checked

If you have a ASP.Net Core app with a controller with the following method:

[HttpGet]
[FeatureGate(FeatureFlags.Foo)]
[Authorize]
public IEnumerable<string> Get()
        {
            return new string[] { "value1", "value2" };
        }

Currently if:

1. A request is made with correct scopes and the feature is turned on -> 200 returned (expected)
2. A request is made with incorrect scopes and the feature is turned on -> 401 returned (expected)
3. A request is made with correct scopes and the feature is turned off -> 404 returned (expected)
4. A request is made with incorrect scopes and the feature is turned off -> 401 returned (unexpected)

In scenario 4 (or any scenario when the feature is turned off) I would have imagined that it would always return a 404 so that a client wouldn't be made aware of new features it doesn't have access to.

Start with the ASP.NET Core controller example and reproduce the four combinations of feature state and authorization scopes. Inspect how [FeatureGate] and [Authorize] are evaluated, then verify that a disabled feature returns 404 regardless of scopes while the enabled-feature cases retain their expected responses.