How to protect all controllers by default with bearer token in ASP.NET Core?

Question

I have added a JWT middleware to my application:

app.UseJwtBearerAuthentication(options => { options.AutomaticAuthenticate = true;} ) 

No the funny thing is that it throws 500 exception (should be changed to 401 in later releases) for ALL actions, even those that are not protected at all (don't have authorize attribute). It seems to me that this is wrong but maybe I am doing something wrong myself.

Ideally what I want to achieve is that all actions are protected by default (there were filters for that in previous ASP.NET), and I will put Anonymous on those that I want public or perhaps Authorize("SomePolicy") if I want additional policies, but I want that without a token the API cannot be accessed at all. How do I do this in the new ASP.NET (I know I can inherit from some controller with this attribute, but I hope there is a better way of doing it)?

Answer 1

Starting with .Net 6 we can do this (if using minimal hosting model recommended by Microsoft):

app.MapControllers().RequireAuthorization(); 

Starting with .Net Core 3 we can do this:

app.UseEndpoints(endpoints => {     endpoints         .MapControllers()         .RequireAuthorization(); // This will set a default policy that says a user has to be authenticated }); 

It is possible to change default policy or add a new policy and use it as well.

P.S. Please note that even though the method name says "Authorization", by default it will only require that the user is Authenticated. It is possible to add more policies to extend the validation though.