title: Custom Authorization policy with multiple requirements not working when applied to controller action
body: <p>I have an .NET Core 3 WebAPI where I want to use custom policy-based authorization, where one of the policies has multiple requirements.</p>
  <p>I have added the policy in <code>Startup.ConfigureServices()</code> and added <code>MyCustomPolicyHandler</code> to DI:</p>
  <pre><code>public virtual void ConfigureServices(IServiceCollection services)
  {
      services.AddAuthorization(options =&gt;
      {
          options.AddPolicy(&quot;MyCustomPolicy&quot;, policy =&gt;
          {
              policy.Requirements.Add(new RequirementA());
              policy.Requirements.Add(new RequirementB());
              policy.Requirements.Add(new RequirementC());
              policy.Requirements.Add(new RequirementD());
              
          });
          
          services.AddScoped&lt;IAuthorizationHandler, MyCustomPolicyHandler&gt;();
          
      });                
  }
  </code></pre>
  <p>I have implemented <code>MyCustomPolicyHandler</code> using the example from this documentation:
  <a href="https://docs.microsoft.com/en-us/aspnet/core/security/authorization/policies?view=aspnetcore-3.1" rel="nofollow noreferrer">Policy-based authorization in ASP.NET Core</a></p>
  <pre><code>public class MyCustomPolicyHandler: IAuthorizationHandler
  {
  
      public Task HandleAsync(AuthorizationHandlerContext context)
      {
      
          var pendingRequirements = context.PendingRequirements.ToList();         
          
          Console.WriteLine($&quot;MyCustomPolicyHandler: {pendingRequirements.Count} requirements&quot;);
          
          foreach (var requirement in pendingRequirements)
          {
              if(requirement is RequirementA) {
              
                  // do stuff to check the requirements
                  context.Succeed(requirement);
                  
              }
              else if(requirement is RequirementB) {
                  
                  // do stuff to check the requirements
                  context.Succeed(requirement);
              
              }
              else if(requirement is RequirementC) {
              
                  // do stuff to check the requirements
                  context.Succeed(requirement);
                  
              }
              else if(requirement is RequirementD) {
                  
                  // do stuff to check the requirements
                  context.Succeed(requirement);
              
              }
          }
          
          return Task.CompletedTask;
      
      }
  }
  </code></pre>
  <p>Next, I apply the policy to one of the controller actions:</p>
  <pre><code>public class MyController 
  {
      [HttpGet]
      [Authorize(Policy=&quot;MyCustomPolicy&quot;)]    
      public ActionResult&lt;SomeViewModel&gt; Get(int id) {
      
          // do stuff
          
          return Ok(vm);
      }
  
  }
  </code></pre>
  <p>The problem I'm encountering is there are no requirements associated with the policy.  The <code>Console.WriteLine()</code> message shows 0 requirements:</p>
  <pre><code>MyCustomPolicyHandler: 0 requirements
  </code></pre>
  <p>If I move the policy to the controller, the requirements are present:</p>
  <pre><code>[Authorize(Policy=&quot;MyCustomPolicy&quot;)]
  public class MyController 
  {
      [HttpGet]
      public ActionResult&lt;SomeViewModel&gt; Get(int id) {
      
          // do stuff
          
          return Ok(vm);
      }
  
  }
  </code></pre>
  <pre><code>MyCustomPolicyHandler: 4 requirements
  </code></pre>
  <p>However, I need this policy applied to the action, not the controller.  The [Authorize(Policy=&quot;MyCustomPolicy&quot;)] attribute should work at the action level.</p>
  <p>Any idea why this isn't working?</p>
  <p>Thanks.</p>