ASP.NET Core 2.0 Disable Authentication in Development Environment

This article describes how to disable authentication for ASP.NET Core 2.0.

ASP.NET Core JWT Authentication

I have some Rest API which I want to protect via JwtBearer token in production e.g.

public void ConfigureServices(IServiceCollection services)
{
   ...
   services.AddAuthentication(options =>
   {
		
      options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
      options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
   }).AddJwtBearer(o =>
		{
      o.Authority = authority;
      o.Audience = audience;
      o.RequireHttpsMetadata = false;
   });
   services.AddMvc();
   ...
   
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
   ...
   app.UseAuthentication();

   app.UseMvc();
   ...
}

public void ConfigureServices(IServiceCollection services)

{

...

services.AddAuthentication(options =>

{

options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;

options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;

}).AddJwtBearer(o =>

{

o.Authority = authority;

o.Audience = audience;

o.RequireHttpsMetadata = false;

});

services.AddMvc();

...

}

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)

{

...

app.UseAuthentication();

app.UseMvc();

...

}

However in order to test the API, for development I totally want to disable authentication without having to remove all Authorizes in the Controllers.

First Attempt

If you however try something like this:

if (!env.IsDevelopment()) {
   ...
   services.AddAuthentication(options =>
   ...
}

if (!env.IsDevelopment()) {

...

services.AddAuthentication(options =>

...

}

you will run into the following error:

An unhandled exception occurred while processing the request.

InvalidOperationException: No authenticationScheme was specified, and there was no DefaultChallengeScheme found.

Solution

It took the quite some time to figure out a valid solution. And it is very simpe as well…

What I ended up doing is this:

if (env.IsDevelopment()) {
   services.AddMvc(opts =>
   {
      opts.Filters.Add(new AllowAnonymousFilter());
   });
} else {
   services.AddMvc();
}

if (env.IsDevelopment()) {

services.AddMvc(opts =>

{

opts.Filters.Add(new AllowAnonymousFilter());

});

} else {

services.AddMvc();

}

Now everyone can access the API in development. Hope this helps someone solve this problem.

If you have any questions or further information, please leave a comment below.

19 Replies to “ASP.NET Core 2.0 Disable Authentication in Development Environment”

Karel Král

2018-05-11 at 15:47

Thank you very much!

Reply ↓
Bunt

2018-07-21 at 23:35

excellent thanks for the tip

Reply ↓
Stephen Haxby

2018-07-23 at 04:56

Excellent, works like a charm… Thank you

Reply ↓
Nirmal

2018-07-27 at 22:53

what will happen if you have policy in the attribute?

[Authorize(Policy = “ServiceAuthorizationPolicy”)]

Reply ↓
Paul

2019-03-12 at 15:47

I explored a lot of complicated options before finding this – thanks very much!

Reply ↓
techbits

2019-03-26 at 17:32

I cannot seem to find which package/namespace has this AllowAnonymousFilter filter?

Reply ↓
1. Sebastian Lindner Post author
  
  2019-03-26 at 18:19
  
  namespace Microsoft.AspNetCore.Mvc.Authorization
  
  Reply ↓
Martin Navarrete

2019-08-14 at 18:10

Thank you man, I was looking for any solution for this, it was very simple with your explanation but another think to add is that if you are putting the code into the ConfigureServices method you have to declare an use the IHostingEnvironment variable in the Startup constructor.

Reply ↓
Stone Robertson

2019-12-12 at 18:29

This technique is indeed simple and elegant. Worked great for me! As Martin N. pointed out, you will not have access to the IHostingEnvironment object in ConfigureServices, so don’t forget to add it as a constructor param for DI.

Reply ↓
ElBartho

2020-02-20 at 20:53

but… where comes this ‘env’ from?

Reply ↓
Sebastian Lindner Post author

2020-02-26 at 09:27

It is IHostingEnvironment env injected into the Configure method by the dependency injection.

Reply ↓
RW Bradley

2020-04-08 at 18:18

Doesn’t seem to work in .Net Core 3.1

Reply ↓
Mike Gold

2020-06-25 at 21:58

Yeah, not working for me when i have a policy on the method, e.g.

[Authorize(Policy = “ManageIceCreamPolicy”)]

I get a 404

Reply ↓
Matt Hancock

2020-07-08 at 18:33

Worked great, thanks for this info!

Reply ↓
Torstein Dahl Bratberg

2021-02-10 at 10:47

Top level answer from link worked for me in core 3.1
https://stackoverflow.com/questions/41112564/asp-net-disable-authentication-in-development-environment

Reply ↓
1. TAFF
  
  2021-08-19 at 09:01
  
  Hello, Absolutely great article here.
  thanks for your easy-to-understand example.
  
  Reply ↓
Simon Elms

2021-10-10 at 02:49

I, like several others by the looks of things, was confused about where “env” came from, given that the code snippets appeared to be from the Startup.ConfigureServices method which doesn’t have an env parameter.

Martin Navarrete put me on the right track, you need to add an IHostingEnvironment parameter to the Startup class constructor, then pass that value to a property you can access in the ConfigureServices method.

Similar to:

public class Startup
{
public IConfiguration Configuration { get; }
public IHostingEnvironment Environment { get; }

public Startup(IConfiguration configuration, IHostingEnvironment environment)
{
Configuration = configuration;
Environment = environment;
}

public IServiceProvider ConfigureServices(IServiceCollection services)
{
…

services.AddMvc(options =>
{
if (Environment.IsDevelopment())
{
options.Filters.Add(new AllowAnonymousFilter());
}

// Set other options here. For example:
options.ModelBinderProviders.Insert(0, new UTCDateTimeModelBinderProvider());

…
});

…
}
}

Reply ↓

Simon Elms

2021-10-10 at 02:51

Whoops, tab indents were stripped, making my code sample a little hard to read. Trying again with spaces instead of tabs:

public class Startup
{
    public IConfiguration Configuration { get; }
    public IHostingEnvironment Environment { get; }
    
    public Startup(IConfiguration configuration, IHostingEnvironment environment)
    {
        Configuration = configuration;
        Environment = environment;
    }

    public IServiceProvider ConfigureServices(IServiceCollection services)
    {    
        ...
        
        services.AddMvc(options =>
        {
            if (Environment.IsDevelopment())
            {
                options.Filters.Add(new AllowAnonymousFilter());
            }
            
            // Set other options here.  For example:
            options.ModelBinderProviders.Insert(0, new UTCDateTimeModelBinderProvider());
            
            ...
        });
        
        ...        
    }
}

public class Startup

{

public IConfiguration Configuration { get; }

public IHostingEnvironment Environment { get; }

public Startup(IConfiguration configuration, IHostingEnvironment environment)

{

Configuration = configuration;

Environment = environment;

}

public IServiceProvider ConfigureServices(IServiceCollection services)

{

...

services.AddMvc(options =>

{

if (Environment.IsDevelopment())

{

options.Filters.Add(new AllowAnonymousFilter());

}

// Set other options here. For example:

options.ModelBinderProviders.Insert(0, new UTCDateTimeModelBinderProvider());

...

});

...

}

Reply ↓

Pingback: ASP.NET Core disable authentication in development environment - Code Utility - Code Utility