Authentication Handler not blocking requests

Question

I have added authentication to my API with the possibility to authenticate with two different authentication schemes. Based on the format of the Auth header I forward the authentication request to the appropriate Authentication handler using a ForwardDefaultSelector.

 services.AddAuthentication(opt =>
                    {
                        opt.DefaultScheme = "ForwardScheme";
                        opt.DefaultChallengeScheme = "ForwardScheme";
                    })
                    .AddPolicyScheme("ForwardScheme", "ForwardScheme", options =>
                        options.ForwardDefaultSelector = context =>
                            context.Request.IsSchemeA()
                                ? "SchemeA"
                                : "SchemeB")
                    .AddSchemeA()
                    .AddSchemeB();

Adding Schemes:

public static AuthenticationBuilder AddSchemeA(this AuthenticationBuilder builder)
        {
            builder.AddScheme<AuthenticationSchemeOptions, SchemeAHandler>(
                "SchemeA", null);
            return builder;
        }

The forwarding seems to be working fine, I can see the request coming to the right auth handler based on the header value.

The problem is even when the auth fails, the API call is not blocked and I still get a 200 response back.

In the AuthHandler I am just returning this:

 return AuthenticateResult.Fail("Authentication Failed");

Any idea what I am missing here? Thanks.

Answer 1

@EnricoMassone thanks for pointing me in the right direction.

I was missing [Authorize] attribute on my controller methods.

you can set the attribute individually on each method or you could do something like this, and it would enable authorization on all methods for all of your controllers