title: System.InvalidOperationException: No authentication handler is configured to handle the scheme: Automatic
body: <p>Scenario:</p>
  
  <ol>
  <li>Create a New Asp.Net Core (version 1.0.0) project</li>
  <li>Choose the Web API template</li>
  <li>Add the <code>[Authorize]</code> attribute on the default ValuesController</li>
  <li>Run the application</li>
  </ol>
  
  <p>If I run the application with IIS and make a GET request to <code>http://localhost:60513/api/values</code> I get the expected <code>401 Unauthorized error</code></p>
  
  <p>If however I run the application with Kestrel (e.g: <code>dotnet run</code>) and make a GET request to <code>http://localhost:5000/api/values</code> I get a <code>500 Internal Server Error</code> with the following exception at kestrel:</p>
  
  <pre><code>Now listening on: http://localhost:5000
  Application started. Press Ctrl+C to shut down.
  info: Microsoft.AspNetCore.Hosting.Internal.WebHost[1]
        Request starting HTTP/1.1 GET http://localhost:5000/api/values
  info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[2]
        Authorization failed for user: .
  warn: Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker[1]
        Authorization failed for the request at filter 'Microsoft.AspNetCore.Mvc.Authorization.AuthorizeFilter'.
  info: Microsoft.AspNetCore.Mvc.ChallengeResult[1]
        Executing ChallengeResult with authentication schemes ().
  fail: Microsoft.AspNetCore.Server.Kestrel[13]
        Connection id "0HKUMMBBBQ6AU": An unhandled exception was thrown by the application.
  System.InvalidOperationException: No authentication handler is configured to handle the scheme: Automatic
     at Microsoft.AspNetCore.Http.Authentication.Internal.DefaultAuthenticationManager.&lt;ChallengeAsync&gt;d__12.MoveNext()
  --- End of stack trace from previous location where exception was thrown ---
     at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
     at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
     at Microsoft.AspNetCore.Mvc.ChallengeResult.&lt;ExecuteResultAsync&gt;d__14.MoveNext()
  --- End of stack trace from previous location where exception was thrown ---
     at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
     at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
     at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.&lt;InvokeResultAsync&gt;d__32.MoveNext()
  --- End of stack trace from previous location where exception was thrown ---
     at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
     at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
     at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.&lt;InvokeAsync&gt;d__18.MoveNext()
  --- End of stack trace from previous location where exception was thrown ---
     at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
     at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
     at Microsoft.AspNetCore.Builder.RouterMiddleware.&lt;Invoke&gt;d__4.MoveNext()
  --- End of stack trace from previous location where exception was thrown ---
     at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
     at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
     at Microsoft.AspNetCore.Hosting.Internal.RequestServicesContainerMiddleware.&lt;Invoke&gt;d__3.MoveNext()
  --- End of stack trace from previous location where exception was thrown ---
     at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
     at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
     at Microsoft.AspNetCore.Server.Kestrel.Internal.Http.Frame`1.&lt;RequestProcessingAsync&gt;d__2.MoveNext()
  info: Microsoft.AspNetCore.Hosting.Internal.WebHost[2]
        Request finished in 282.8427ms 200
  </code></pre>
  
  <p>My question is <strong>Why my application has different result depending on the server hosting it?</strong> Why Kestrel and IIS handle the Authorization differently?</p>
  
  <p>Please note that there are similar questions in StackOverflow like <a href="https://stackoverflow.com/questions/33825058/no-authentication-handler-is-configured-to-handle-the-scheme-automatic">this</a> or <a href="https://stackoverflow.com/questions/38968422/no-authentication-handler-is-configured-to-handle-the-scheme">this other</a> but they all are for more complex scenarios where filters or middleware are involved.</p>
  
  <p>I do not have any middleware in the AspNet pipeline other than MVC, and all the code but the <code>[Authorize]</code> attribute is automatically generated by the AspNet Web Api template.</p>