ASP.NET Core: 'a middleware was not found that supports authorization'

Endpoint ... contains authorization metadata, but a middleware was not found that supports authorization. means an endpoint carries RequireAuthorization() or [Authorize], yet no authorization middleware ran before it. In the test below the app registered no authorization services at all; registering authentication and authorization services made the endpoint answer.

The message tells you to add app.UseAuthorization(). On its own that crashed the app at startup in this test, asking for AddAuthorization. Registering AddAuthentication(...) with a scheme plus AddAuthorization() fixed it, and the protected endpoint answered with a redirect to the login page.

The error

fail: Microsoft.AspNetCore.Server.Kestrel[13]
      Connection id "0HNPRRA5DLI3G", Request id "0HNPRRA5DLI3G:00000001": An unhandled exception was thrown by the application.
      System.InvalidOperationException: Endpoint HTTP: GET /admin contains authorization metadata, but a middleware was not found that supports authorization.
      Configure your application startup by adding app.UseAuthorization() in the application startup code. If there are calls to app.UseRouting() and app.UseEndpoints(...), the call to app.UseAuthorization() must go between them.
         at Microsoft.AspNetCore.Routing.EndpointMiddleware.ThrowMissingAuthMiddlewareException(Endpoint endpoint)
...

Why it happens

The broken app had one line that asked for authorization and nothing that provided it:

app.MapGet("/admin", () => "admin area").RequireAuthorization();

RequireAuthorization() only attaches metadata to the endpoint. When the request reached the endpoint, nothing had checked that metadata, and the stack trace shows the exception raised from EndpointMiddleware. The client received an empty 500 Internal Server Error.

Two half-fixes were tried on the way. Adding only app.UseAuthorization() stopped the app at startup with Unable to find the required services. Please add all the required services by calling 'IServiceCollection.AddAuthorization'. Adding only builder.Services.AddAuthorization() moved the failure to the request: Unable to find the required 'IAuthenticationService' service, because an anonymous request has to be challenged and there was no authentication to do it.

The fix

builder.Services.AddAuthentication("Cookies").AddCookie("Cookies");
builder.Services.AddAuthorization();
...
app.MapGet("/admin", () => "admin area").RequireAuthorization();

With both services registered, GET /admin without a cookie answered 302 Found with Location: http://127.0.0.1:15707/Account/Login?ReturnUrl=%2Fadmin. This program called neither app.UseAuthentication() nor app.UseAuthorization(); with the services registered, the request reached the authorization check anyway. The cookie scheme was the one tested; the point is a named scheme plus the authorization services.

How it was reproduced

A dotnet new web project (net10.0) with the endpoint above, started on http://127.0.0.1:15702 in the Production environment and called with curl.exe -s -D - -o logs/authz-body.txt http://127.0.0.1:15702/admin. The two half-fixes ran on ports 15712 and 15706, the fix on 15707. .NET SDK 10.0.403, Microsoft.AspNetCore.App 10.0.14, Windows 11.

Frequently asked

Is adding app.UseAuthorization() enough to fix 'a middleware was not found that supports authorization'?

Not in the test. With no services registered, app.UseAuthorization() made the app stop at startup and ask for IServiceCollection.AddAuthorization. Register the services as well.

Why do I get 'Unable to find the required IAuthenticationService service' after adding AddAuthorization?

The endpoint needed to challenge an anonymous request and no authentication was registered. Adding AddAuthentication with a scheme, for example AddAuthentication("Cookies").AddCookie("Cookies"), fixed it.

Does RequireAuthorization() protect an endpoint by itself?

No. It only marks the endpoint. Without authorization services and middleware the request failed with a 500 instead of being checked.

More decoded errors in the Fixes category, including the next one you may hit on the way: No authenticationScheme was specified.