Schemes, challenges and .NET middleware order

Understand how Authenticate, Challenge and Forbid become HTTP behaviour.

UnderstandStudy an examplePractise

Understand the concept

A scheme names an authentication handler and its behaviour. An application can use cookies for web sessions and Bearer for an API. Defaults and explicitly selected policy schemes can differ. Define which endpoint accepts which evidence instead of allowing a client-controlled field to choose authentication arbitrarily.

Authenticate inspects evidence. Challenge requests suitable credentials: Bearer commonly produces 401 with WWW-Authenticate, while a cookie web flow may redirect to login. Forbid denies access: Bearer commonly produces 403, while a cookie handler can redirect to an access-denied page. Configure API behaviour deliberately rather than unexpectedly returning HTML to a JSON client.

The pipeline must establish identity before evaluating permissions. Register handlers and place authentication before authorisation, considering routing and CORS as well. Test default and fallback policies plus anonymous exceptions. These educational fragments do not modify this site’s security configuration.

WHEN TO USE IT

When diagnosing unexpected 302 or HTML responses from a .NET API.

COMMON PITFALL

Assuming AddAuthentication automatically protects every resource.

01 / PRACTICE

One topic. Three levels of depth.

HTTP / illustrative example

app.UseRouting();
app.UseCors("Frontend");
app.UseAuthentication();
app.UseAuthorization();

Illustrative order; handler and policy service registration is also needed.

This page does not send requests to external servers. Messages are readable HTTP/1.1 illustrations, not HTTP/2 or HTTP/3 wire dumps. example.test is reserved for examples. Run commands and JavaScript only in your own test environment; never publish real tokens or cookies.

02 / YOUR TURN

Try it yourself first.

Your API returns login HTML instead of JSON. What should you inspect first?

Show the solution and explanation

Worked solution

Inspect selected authentication scheme and cookie redirect events.

Inspect cookie challenge redirection and API-specific response behaviour.

RasimAtaberkŞahin

Understand the concept

One topic. Three levels of depth.

Try it yourself first.