ASP.NET Core: 'No authenticationScheme was specified, and there was no DefaultChallengeScheme found'

InvalidOperationException: No authenticationScheme was specified, and there was no DefaultChallengeScheme found. means ASP.NET Core had to challenge an anonymous request and did not know which authentication handler should do it. Pass a default scheme to AddAuthentication and register a handler for that scheme.

In the test, changing AddAuthentication() to AddAuthentication("Cookies").AddCookie("Cookies") turned the 500 into a 302 redirect to the login page.

The error

fail: Microsoft.AspNetCore.Server.Kestrel[13]
      Connection id "0HNPRRA5EG1LE", Request id "0HNPRRA5EG1LE:00000001": An unhandled exception was thrown by the application.
      System.InvalidOperationException: No authenticationScheme was specified, and there was no DefaultChallengeScheme found. The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action<AuthenticationOptions> configureOptions).
         at Microsoft.AspNetCore.Authentication.AuthenticationService.ChallengeAsync(HttpContext context, String scheme, AuthenticationProperties properties)
...

The client received HTTP/1.1 500 Internal Server Error with an empty body; the text above is from the server's console log.

Why it happens

The broken app registered the services but named no scheme:

builder.Services.AddAuthentication();
builder.Services.AddAuthorization();
...
app.MapGet("/admin", () => "admin area").RequireAuthorization();

A request to /admin without credentials failed the authorization policy, so the authorization middleware asked the authentication service to challenge it. The stack trace shows that call, AuthenticationService.ChallengeAsync, with no scheme passed in and no default configured, and it threw. AddAuthentication() with no arguments registered the service but no handler and no default, so there was nothing to send the client to.

Note where it failed: at the first request to a protected endpoint, not at startup. The app started and logged Now listening on: http://127.0.0.1:15703, and in a second run of the same program the root endpoint, which has no RequireAuthorization(), answered 200 OK with Hello World!. A quick smoke test of the home page would not have caught it.

The fix

builder.Services.AddAuthentication("Cookies").AddCookie("Cookies");
builder.Services.AddAuthorization();
...
app.MapGet("/admin", () => "admin area").RequireAuthorization();

After the change the same request answered 302 Found with Location: http://127.0.0.1:15707/Account/Login?ReturnUrl=%2Fadmin, which is the cookie handler sending the visitor to its login path. The string passed to AddAuthentication is the default scheme and the name given to AddCookie registers the handler under that name; in the fix both are "Cookies". The exception message also names a second overload, which sets the defaults through an AuthenticationOptions callback; that one was not tried here.

How it was reproduced

A dotnet new web project (net10.0) with the code above, started on http://127.0.0.1:15703 in the Production environment and called with curl.exe -s -D - -o logs/noscheme-body.txt http://127.0.0.1:15703/admin. The fixed program ran on port 15707. .NET SDK 10.0.403, Microsoft.AspNetCore.App 10.0.14, Windows 11; the cookie handler ships with the shared framework, so no package was added.

Frequently asked

How do I set the DefaultChallengeScheme in ASP.NET Core?

Pass the scheme name to AddAuthentication and register a handler with the same name, for example AddAuthentication("Cookies").AddCookie("Cookies"). The overload with an AuthenticationOptions callback is the other way the message names.

Why does [Authorize] return 500 instead of 401 or a login redirect?

In the test the anonymous request had to be challenged and no scheme was configured, so ChallengeAsync threw and the app returned an empty 500. With a cookie scheme the same request got a 302 to the login page.

Is AddAuthentication() without arguments enough?

Not here. It registered the authentication service, but with no handler and no default scheme the first challenge failed with this exception.

More decoded errors in the Fixes category. If the error instead says a middleware that supports authorization was not found, see Endpoint contains authorization metadata.