Skip to content

Commit 8556ff5

Browse files
authored
Fix SetDefaultPolicy being used like SetFallbackPolicy (#36186)
1 parent 5ff72a6 commit 8556ff5

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

aspnetcore/security/authentication/configure-jwt-bearer-authentication.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -180,15 +180,15 @@ APIs often need to accommodate access tokens from various issuers. Supporting mu
180180

181181
### Forcing the bearer authentication
182182

183-
<xref:Microsoft.AspNetCore.Authorization.AuthorizationBuilder.SetDefaultPolicy%2A> can be used to require authentication for all requests even to endpoints without an `[Authorize]` attribute. <xref:Microsoft.AspNetCore.Authorization.AuthorizationBuilder.SetDefaultPolicy%2A> configures the policy used for endpoints with the `[Authorize]` attribute and already defaults to requiring authenticated users. See the [require authenticated users documentation](/aspnet/core/security/authorization/secure-data#require-authenticated-users) for more details.
183+
<xref:Microsoft.AspNetCore.Authorization.AuthorizationBuilder.SetFallbackPolicy%2A> can be used to require authentication for all requests even to endpoints without an `[Authorize]` attribute. <xref:Microsoft.AspNetCore.Authorization.AuthorizationBuilder.SetDefaultPolicy%2A> configures the policy used for endpoints with the `[Authorize]` attribute and already defaults to requiring authenticated users. See the [require authenticated users documentation](/aspnet/core/security/authorization/secure-data#require-authenticated-users) for more details.
184184

185185
```csharp
186186
var requireAuthPolicy = new AuthorizationPolicyBuilder()
187187
.RequireAuthenticatedUser()
188188
.Build();
189189

190190
builder.Services.AddAuthorizationBuilder()
191-
.SetDefaultPolicy(requireAuthPolicy);
191+
.SetFallbackPolicy(requireAuthPolicy);
192192
```
193193

194194
The <xref:Microsoft.AspNetCore.Authorization.AuthorizeAttribute> attribute can also be used to force the authentication. If multiple schemes are used, the bearer scheme generally needs to be set as the default authentication scheme or specified via `[Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme])`.

0 commit comments

Comments
 (0)