title: AllowAnonymous not working with ASP.NET Core 6.0 Web API
body: <p>I have the following authentication configuration in ASP.NET Core 6.0, with a custom authentication scheme:</p>
  <pre class="lang-cs prettyprint-override"><code>// Enable authentication, add a custom scheme and set it as the default
  builder.Services.AddAuthentication(opts =&gt;
          opts.DefaultAuthenticateScheme = &quot;Custom&quot;)
      .AddScheme&lt;CustomAuthSchemeOptions, CustomAuthSchemeHandler&gt;(&quot;Custom&quot;, null);
  
  // stuff...
  
  app.UseAuthentication();
  app.UseAuthorization();
  
  // Use attribute routing for the Web API
  app.MapControllers();
  </code></pre>
  <p>Options are empty, while the <code>CustomAuthSchemeHandler</code> can be something as simple as this:</p>
  <pre class="lang-cs prettyprint-override"><code>public class CustomAuthSchemeHandler: AuthenticationHandler&lt;CustomAuthSchemeOptions&gt;
  {
      public CustomAuthSchemeHandler(
          IOptionsMonitor&lt;CustomAuthSchemeOptions&gt; options,
          ILoggerFactory logger,
          UrlEncoder encoder,
          ISystemClock clock) : base(options, logger, encoder, clock)
      {
      }
  
      protected async override Task&lt;AuthenticateResult&gt; HandleAuthenticateAsync()
      {
          Console.WriteLine(&quot;Authenticating...&quot;); // the logger, yeah yeah...
          var principal = new ClaimsPrincipal(new ClaimsIdentity(&quot;Test&quot;));
          var ticket = new AuthenticationTicket(principal, &quot;Custom&quot;);
          return AuthenticateResult.Success(ticket);
      }
  }
  </code></pre>
  <p>Now, what I understand (although apparently undocumented) is that <strong>if I set the default authentication scheme</strong> as in the code above, <strong>authentication is automatically enforced on all controllers and actions</strong>.</p>
  <p>Now what if I wanted to have a <strong>controller/action with no authentication</strong>?</p>
  <p>My understanding is that there are two options:</p>
  <ul>
  <li><p>Remove the default authentication scheme and use the <code>[Authorize]</code> attribute explicitly where needed</p>
  </li>
  <li><p>Use the <code>[AllowAnonymous]</code> attribute to disable authentication in specific contexts</p>
  </li>
  </ul>
  <p>The first option works, but I can't get the <code>[AllowAnonymous]</code> approach to work.</p>
  <p>The following code behaves as if the <code>[AllowAnonymous]</code> wasn't there, i.e. the authentication scheme handler is called anyway and the user is authenticated.</p>
  <pre class="lang-cs prettyprint-override"><code>[ApiController]
  [Route(&quot;[controller]&quot;)]
  public class WeatherForecastController : ControllerBase
  {
      [HttpGet(&quot;test&quot;)]
      [AllowAnonymous]
      // ^^^^^^^^^^^^^
      public string Get()
      {
          return HttpContext.User.Identity.IsAuthenticated ? &quot;YES&quot; : &quot;NO&quot;;
      }
  }
  </code></pre>
  <p>What am I missing?</p>
  <p>Thanks!</p>