All 15 Authentication questions
More in Authentication
How does cookie-based authentication work in ASP.NET Core, and when is it preferred over token-based authentication? How do you configure ASP.NET Core to support multiple authentication schemes simultaneously, such as both cookies for a web UI and JWT for an API? What is ASP.NET Core Identity, and how does it provide a complete user account management system? How does two-factor authentication (2FA) work with ASP.NET Core Identity, and what does the sign-in flow look like? How do claims transformations (IClaimsTransformation) let you augment a user's claims after initial authentication but before authorization checks run? What is the difference between IAuthenticationService's SignInAsync/SignOutAsync methods and simply checking if a user 'is authenticated'? How does JWT bearer authentication validate an incoming token, and what claims does TokenValidationParameters check? How do external identity provider integrations (like Google or Microsoft Entra ID) work using OAuth/OpenID Connect authentication handlers? How do refresh tokens work alongside short-lived JWT access tokens, and how would you implement a refresh endpoint? How do you implement API key authentication as a custom authentication scheme for machine-to-machine API access?
Advertisement
ASP.NET Core › Authentication

What is the purpose of the authentication middleware's position in the pipeline, and why must UseAuthentication come before UseAuthorization?

Intermediate

Answer

UseAuthentication establishes the request's identity (populating HttpContext.User) by running the configured authentication handler(s), which UseAuthorization then depends on to evaluate policy and role requirements -- registering them in the wrong order means authorization checks would run against an unauthenticated (empty) principal, incorrectly rejecting legitimately authenticated users.
app.UseRouting();
app.UseAuthentication();  // MUST come first: establishes HttpContext.User
app.UseAuthorization();   // depends on User already being populated
app.MapControllers();
Real-world example A team debugging why all authenticated requests were incorrectly receiving 401 responses discovers UseAuthorization was accidentally registered before UseAuthentication, meaning no identity had been established yet when authorization checks ran.

Common follow-ups: What HttpContext state does UseAuthentication actually populate?;Does this ordering requirement apply the same way to minimal APIs as MVC controllers?

ASP.NET Core Middleware & Request Pipeline;Authorization
All 15 Authentication questions