Exploring Changes to Authentication and Authorization Setup in .NET 7 API with JWT

Question

I've recently been exploring the latest features in .NET 7 and have noticed an interesting change related to JWT authentication. In previous versions of ASP.NET Core, we were required to use the UseAuthentication() and UseAuthorization() methods in the Startup class to enable authentication and authorization middleware. However, in my experimentation with .NET 7, I've observed that these calls might not be necessary anymore for JWT authentication scenarios.

In the past, the standard setup for enabling authentication and authorization looked something like this in the Startup.cs:

public void ConfigureServices(IServiceCollection services)
{
    // Other services configuration
    
    services.AddAuthentication();
    services.AddAuthorization();
    
    // More configuration
}

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    // Other app configuration
    
    app.UseAuthentication();
    app.UseAuthorization();
    
    // More configuration
}

However, in my .NET 7 projects, I've found that even without explicitly calling UseAuthentication() and UseAuthorization(), JWT authentication seems to work as expected.

Here's what the updated Program.cs file might look like:

using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Hosting;

namespace DemoNamespace
{
    public class Program
    {
        public static void Main(string[] args)
        {
            CreateHostBuilder(args).Build().Run();
        }

        public static IHostBuilder CreateHostBuilder(string[] args) =>
            Host.CreateDefaultBuilder(args)
                .ConfigureWebHostDefaults(webBuilder =>
                {
                    webBuilder.UseStartup<Startup>(); 
                });
    }
}

This change raises a couple of questions for me:

1. Is this change documented officially by Microsoft? I've scoured the official documentation but haven't found explicit information regarding this change. If it is documented, could you please point me to the relevant resource?

2. Are there any potential drawbacks or limitations to not using these calls? While it's convenient to have less code clutter, I'm concerned that there might be scenarios or edge cases where not calling these methods could lead to unexpected behavior or security vulnerabilities.

3. Could this behavior change in future updates of .NET 7 or in subsequent versions? As with any software development, behaviors can change over time. It would be great to know if this is a deliberate design change or just a temporary state.

I'm eager to hear from the experts in the community who have delved into .NET 7's authentication and authorization changes. Have you encountered this alteration in behavior, and if so, what are your thoughts on it? Are there any best practices or caveats you would recommend when deciding whether or not to explicitly use UseAuthentication() and UseAuthorization()?

Thank you for sharing your insights and experiences!

Can anyone please help me here by providing their guidance

Answer 1

ASP.NET Core adds these handlers automatically for you if you have registered handles related to them.

app.UseAuthentication();
app.UseAuthorization();

But, I think its still good to add them manually, to make the implicit explicit. Adding them manually will not add them twice.

You can find where they add it for you in the source code here.