title: How to bypass authentication middleware when not needed in ASP.NET Core
body: <p>I have the following authentication handler:</p>
  
  <pre><code>public class CustomAuthenticationHandler : AuthenticationHandler&lt;CustomAuthenticationSchemeOptions&gt;
  {
      public CustomAuthenticationHandler (
          IOptionsMonitor&lt;CustomAuthenticationSchemeOptions&gt; options,
          ILoggerFactory logger,
          UrlEncoder encoder,
          ISystemClock clock) : base(options, logger, encoder, clock)
      {
      }
  
      protected override async Task&lt;AuthenticateResult&gt; HandleAuthenticateAsync()
      {
          var data = await GetDataFromDatabase(); //heavy load
          if(data.IsAuth)
          {
            var identity = new ClaimsIdentity(claims, Scheme.Name);
            var principal = new ClaimsPrincipal(identity);
            var ticket = new AuthenticationTicket(principal, Scheme.Name);
  
            return Task.FromResult(AuthenticateResult.Success(ticket));
         }
         return Task.FromResult(AuthenticateResult.Failed("Not authenticated"));
      }
  }
  </code></pre>
  
  <p>I register it like this in <code>ConfigureServices</code>:</p>
  
  <pre><code>services.AddAuthentication(options =&gt;
      {
        options.DefaultAuthenticateScheme = CustomAuthenticationSchemeOptions.SchemeName;
        options.DefaultChallengeScheme = CustomAuthenticationSchemeOptions.SchemeName;
      })
      .AddScheme&lt;CustomAuthenticationSchemeOptions, CustomAuthenticationHandler&gt;(CustomAuthenticationSchemeOptions.SchemeName, null);
  </code></pre>
  
  <p>Then I use it like this in <code>Configure</code>:</p>
  
  <pre><code>app.UseAuthentication();
  </code></pre>
  
  <p>I have several <code>Controllers</code> with several <code>Actions</code>. Some of those actions should be accessed only after authentication.</p>
  
  <p>I thought that if I use the <code>[Authorize]</code> attribute, I make sure that only authenticated users can access it, so my middleware will be called with that request and the authentication protocol is executed (I guess it would be a very elegant and efficient solution).</p>
  
  <pre><code>public class RegisterController: ControllerBase
  {
     public async Task&lt;AsyncResult&lt;int&gt;&gt;&gt; Reg(string name)
     {
       //...
     }
  }
  
  [Authorize]
  public class DataController: Controller
  {
     public async Task&lt;AsyncResult&lt;Data&gt;&gt;&gt; GetData(int dataId)
     {
       //...
     }
  }
  </code></pre>
  
  <p>It seems that I was wrong, as <em>each middleware is <a href="https://docs.microsoft.com/en-us/aspnet/core/fundamentals/middleware/?view=aspnetcore-2.2#create-a-middleware-pipeline-with-iapplicationbuilder" rel="noreferrer">called each time</a> when a request arrives</em>. </p>
  
  <p>So if I don't want to search the database after each <code>Action</code> request, I have to filter when the middleware is used.</p>
  
  <p>I see some condition-based solution to use <a href="https://www.devtrends.co.uk/blog/conditional-middleware-based-on-request-in-asp.net-core" rel="noreferrer"><code>app.UseWhen</code></a> and test the request path and other cumbersome ways.</p>
  
  <p>Is there a more elegant and efficient way? As I have many actions, I can't create path checking for every one of them.</p>