Authorize attribute not working because it's executed before app.UseAuthentication()

[donnyv]

I just ran across this issue and spent a morning on it.
aspnet/SignalR#2316

Can this be added in the documentation somewhere? Maybe here?
https://docs.microsoft.com/en-us/aspnet/signalr/overview/security/hub-authorization

[mikaelm12]

The docs you linked to are actually referring to Classis ASP.NET SignalR (Sorry for the confusion). Here are the ASP.NET Core SignalR Docs. They do have more information on this matter.
https://docs.microsoft.com/en-us/aspnet/core/signalr/authn-and-authz?view=aspnetcore-2.2#bearer-token-authentication

[donnyv]

It doesn't talk about the ordering of the calls though. How UseAuthentication() should be called first before UseSignalR()

[mikaelm12]

Sure, we could call out that you have to register the Auth middleware before calling UseSignalR

[mikaelm12]

Going to close this in favor of a docs issue I opened here: dotnet/AspNetCore.Docs#11389