{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/967","repository_url":"https://api.github.com/repos/aspnet/Security","labels_url":"https://api.github.com/repos/aspnet/Security/issues/967/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/967/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/967/events","html_url":"https://github.com/aspnet/Security/issues/967","id":175425654,"number":967,"title":"System.InvalidOperationException: No authentication handler is configured to handle the scheme: Automatic","user":{"login":"iberodev","id":5520769,"avatar_url":"https://avatars.githubusercontent.com/u/5520769?v=3","gravatar_id":"","url":"https://api.github.com/users/iberodev","html_url":"https://github.com/iberodev","followers_url":"https://api.github.com/users/iberodev/followers","following_url":"https://api.github.com/users/iberodev/following{/other_user}","gists_url":"https://api.github.com/users/iberodev/gists{/gist_id}","starred_url":"https://api.github.com/users/iberodev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iberodev/subscriptions","organizations_url":"https://api.github.com/users/iberodev/orgs","repos_url":"https://api.github.com/users/iberodev/repos","events_url":"https://api.github.com/users/iberodev/events{/privacy}","received_events_url":"https://api.github.com/users/iberodev/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-09-07T06:47:41Z","updated_at":"2016-09-07T12:37:53Z","closed_at":null,"body":"This might be a bug with Kestrel (not with IIS).\r\n\r\nScenario:\r\n\r\n 1. Create a New Asp.Net Core (version 1.0.0) project\r\n 2. Choose the Web API template\r\n 3. Add the `[Authorize]` attribute on the default ValuesController\r\n 4. Run the application\r\n\r\nIf I run the application with IIS and make a GET request to `http://localhost:60513/api/values` I get the expected `401 Unauthorized error `\r\n\r\nIf however I run the application with Kestrel (e.g: `dotnet run`) and make a GET request to `http://localhost:5000/api/values` I get a `500 Internal Server Error` with the following exception at kestrel:\r\n\r\n\r\n    Now listening on: http://localhost:5000\r\n    Application started. Press Ctrl+C to shut down.\r\n    info: Microsoft.AspNetCore.Hosting.Internal.WebHost[1]\r\n          Request starting HTTP/1.1 GET http://localhost:5000/api/values\r\n    info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[2]\r\n          Authorization failed for user: .\r\n    warn: Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker[1]\r\n          Authorization failed for the request at filter 'Microsoft.AspNetCore.Mvc.Authorization.AuthorizeFilter'.\r\n    info: Microsoft.AspNetCore.Mvc.ChallengeResult[1]\r\n          Executing ChallengeResult with authentication schemes ().\r\n    fail: Microsoft.AspNetCore.Server.Kestrel[13]\r\n          Connection id \"0HKUMMBBBQ6AU\": An unhandled exception was thrown by the application.\r\n    System.InvalidOperationException: No authentication handler is configured to handle the scheme: Automatic\r\n       at Microsoft.AspNetCore.Http.Authentication.Internal.DefaultAuthenticationManager.<ChallengeAsync>d__12.MoveNext()\r\n    --- End of stack trace from previous location where exception was thrown ---\r\n       at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n       at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n       at Microsoft.AspNetCore.Mvc.ChallengeResult.<ExecuteResultAsync>d__14.MoveNext()\r\n    --- End of stack trace from previous location where exception was thrown ---\r\n       at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n       at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n       at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.<InvokeResultAsync>d__32.MoveNext()\r\n    --- End of stack trace from previous location where exception was thrown ---\r\n       at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n       at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n       at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.<InvokeAsync>d__18.MoveNext()\r\n    --- End of stack trace from previous location where exception was thrown ---\r\n       at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n       at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n       at Microsoft.AspNetCore.Builder.RouterMiddleware.<Invoke>d__4.MoveNext()\r\n    --- End of stack trace from previous location where exception was thrown ---\r\n       at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n       at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n       at Microsoft.AspNetCore.Hosting.Internal.RequestServicesContainerMiddleware.<Invoke>d__3.MoveNext()\r\n    --- End of stack trace from previous location where exception was thrown ---\r\n       at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n       at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n       at Microsoft.AspNetCore.Server.Kestrel.Internal.Http.Frame`1.<RequestProcessingAsync>d__2.MoveNext()\r\n    info: Microsoft.AspNetCore.Hosting.Internal.WebHost[2]\r\n          Request finished in 282.8427ms 200\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/aspnet/Security/issues/comments/245267145","html_url":"https://github.com/aspnet/Security/issues/967#issuecomment-245267145","issue_url":"https://api.github.com/repos/aspnet/Security/issues/967","id":245267145,"user":{"login":"Tratcher","id":1821173,"avatar_url":"https://avatars.githubusercontent.com/u/1821173?v=3","gravatar_id":"","url":"https://api.github.com/users/Tratcher","html_url":"https://github.com/Tratcher","followers_url":"https://api.github.com/users/Tratcher/followers","following_url":"https://api.github.com/users/Tratcher/following{/other_user}","gists_url":"https://api.github.com/users/Tratcher/gists{/gist_id}","starred_url":"https://api.github.com/users/Tratcher/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Tratcher/subscriptions","organizations_url":"https://api.github.com/users/Tratcher/orgs","repos_url":"https://api.github.com/users/Tratcher/repos","events_url":"https://api.github.com/users/Tratcher/events{/privacy}","received_events_url":"https://api.github.com/users/Tratcher/received_events","type":"User","site_admin":false},"created_at":"2016-09-07T12:37:53Z","updated_at":"2016-09-07T12:37:53Z","body":"Authorize requires at least one auth middleware in order to issue challenges. In IIS the IISMiddleware acts as an auth middleware and sets a 401 so IIS will set windows auth challenge headers. That doesn't apply when running just Kestrel, you need something like CookieAuth or JwtBearer, etc.."}}
{"actor":{"display_login":"Tratcher"}}