.Net Core 3 preview 6 JWT issue

[Julien-Marpault]

.Net Core 3 preview 6
I get an issue securing an API with JWT

In ConfigureServices method I put these services:

  services.AddAuthentication(options =>
            {
                options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;

            })
            .AddJwtBearer(options =>
            {
                options.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = true,
                    ValidateAudience = true,
                    ValidateLifetime = true,
                    ValidIssuer = Configuration["Jwt:Issuer"],
                    ValidAudience = Configuration["Jwt:Audience"],
                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:Key"]))
                };
            });

In Configure method I put thes middlewares

  app.UseResponseCompression();
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
                app.UseBlazorDebugging();
            }
            app.UseAuthorization();
            app.UseAuthentication();            
            app.UseClientSideBlazorFiles<Client.Startup>();
            app.UseRouting();
            app.UseEndpoints(endpoints =>
            {
                endpoints.MapDefaultControllerRoute();
                endpoints.MapFallbackToClientSideBlazor<Client.Startup>("index.html");
            });

And my controllers are like this:

    [Authorize]
    [ApiController]
    [Produces("application/json")]
    [Route("api/[controller]")]
    public class TicketsController : ControllerBase
    {
      Removed for clarity
    }

But when I make a request without the token,
the server returns the result instead a "not authorized result"

I checked the documentation about JWT, It seems right.

Is anyone have an idea ?

Thanks

[Julien-Marpault]

I found my answer in this pull request: #11621

The correct order for midlewares is:

 app.UseRouting();

app.UseAuthentication();

app.UseAuthorization();

After this sort, it works fine.