c# - Cookie Authentication not working with Authorization policy in asp.net core -

upgrading scott wildermuth's world trip app asp.net core 2.0. code below not working.

since using 2 authentication types , both work on api controllers, decided use authorization policy.

public void configureservices(iservicecollection services) {    //some codes here    services.addauthentication()        .addcookie()        .addjwtbearer(**implementation fine**);     services.addauthorization(options =>    {        options.addpolicy("authenticated", policy =>        {            policy.addauthenticationschemes(                cookieauthenticationdefaults.authenticationscheme,                jwtbearerdefaults.authenticationscheme)                    .requireauthenticateduser();        });    }); } 

now in controllers,

namespace theworld.controllers.api {     [route("api/trips")]     [authorize(policy: "authenticated")]     public class tripscontroller : controller     {       // implementation fine     } } 

requests coming client (web) cookie authentication never seen authenticated while requests jwt authenticated clients work expected.

it works cookie authentication if use simple [authorize] on controller, in asp.net core chooses default cookie authentication , never accepts requests jwt clients.

policy.addauthenticationschemes(scheme1, scheme2) 

this means in order policy authentication successful, both specified authentication schemes must succeed.

your 2 authentication schemes set when jwt authentication succeeds, automatically succeed cookie authentication (to set cookie in case, on further requests jwt token no longer necessary cookie enough). when jwt authentication successful, cookie authentication successful. however, reverse not true: if you’re using cookie establish authentication, jwt token may not there @ all.

if not care which authentication scheme provided authentication, should remove addauthenticationschemes call. saying policy.requireauthenticateduser() saying there needs some authentication scheme authenticated user.

this btw. exact same behavior, default policy (with [authorize]) has.