title: ASP.NET Core 2.0 combining Cookies and Bearer Authorization for the same endpoint
body: <p>I've created a new ASP.NET Core Web Application project in VS17 using the "Web Application (Model-View-Controller)" template and ".Net Framework" + "ASP.NET Core 2" as the configuration. The authentication config is set to "Individual User Accounts".</p>
  
  <p>I have the following sample endpoint:</p>
  
  <pre><code>[Produces("application/json")]
  [Route("api/price")]
  [Authorize(Roles = "PriceViwer", AuthenticationSchemes = "Cookies,Bearer")]
  public class PriceController : Controller
  {
  
      public IActionResult Get()
      {
          return Ok(new Dictionary&lt;string, string&gt; { {"Galleon/Pound",
                                                     "999.999" } );
      }
  }
  </code></pre>
  
  <p><code>"Cookies,Bearer"</code> is derived by  concatenating <code>CookieAuthenticationDefaults.AuthenticationScheme</code> and <code>JwtBearerDefaults.AuthenticationScheme</code>.</p>
  
  <p>The objective is to be able to configure the authorization for the end point so that it's possible access it using both the token and cookie authentication methods.</p>
  
  <p>Here is the setup I have for Authentication in my Startup.cs:</p>
  
  <pre><code>    services.AddAuthentication()
          .AddCookie(cfg =&gt; { cfg.SlidingExpiration = true;})
          .AddJwtBearer(cfg =&gt; {
              cfg.RequireHttpsMetadata = false;
              cfg.SaveToken = true;
              cfg.TokenValidationParameters = new TokenValidationParameters() {
                                                      ValidIssuer = Configuration["Tokens:Issuer"],
                                                      ValidAudience = Configuration["Tokens:Issuer"],
                                                      IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Tokens:Key"]))
                                                  };
          });
  </code></pre>
  
  <p>So, when I try to access the endpoint using a browser, I get the 401 response with a blank html page.<br>
  <a href="https://i.stack.imgur.com/5jCqW.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/5jCqW.jpg" alt="I get the 401 response with a blank html page."></a></p>
  
  <p>Then I login and when I try to access the endpoint again, I get the same response.</p>
  
  <p>Then, I try to access the endpoint by specifying the bearer token. And that returns the desired result with the 200 response.<br>
  <a href="https://i.stack.imgur.com/TZCnI.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/TZCnI.jpg" alt="And that returns the desired result with the 200 response."></a></p>
  
  <p>So then, if I remove <code>[Authorize(AuthenticationSchemes = "Cookies,Bearer")]</code>, the situation becomes the opposite - cookie authentication works and returns 200, however the same bearer token method as used above doesn't give any results and just redirect to the default AspIdentity login page.</p>
  
  <p>I can see two possible problems here:</p>
  
  <p>1) ASP.NET Core doesn't allow 'combined' authentication.
  2) 'Cookies' is not a valid schema name. But then what is the right one to use?</p>
  
  <p>Please advise. Thank you.</p>