title: Authorize attribute always returns 401 after upgrading to NET Core 3.1
body: <p>My NET Core 3.1 rest API is currently returning a 401 on calls marked with an [Authorize] attribute. Calls that do not have an authorize attribute, or those that allow anonymous, or if I remove the authorize attribute from the controller, are successful. </p>
  
  <p>I have recently updated the API from Core 2 to core 3.1, which leads me to believe that the code is expected differently between 2 to 3.1.</p>
  
  <p>From looking at other questions on StackOverflow and online, most point to the order of items within the Configure function in start up, though mine looks to match that which is on the Microsoft docs. I have not changed my token generation code since updating from 2 to 3.1 tokens do look valid when I receive them and test them within JWT.io, but as before when running the call via Postman, or from the front end application the call immediately 401s on the Authorization step.</p>
  
  <p>Below are a few snippets of code:</p>
  
  <p>Startup.cs - ConfigureServices</p>
  
  <pre><code>    public void ConfigureServices(IServiceCollection services)
      {
          services.AddCors();
          services.AddControllers();
  
          // Get appsettings from config file
          var appSettingsSection = Configuration.GetSection("AppSettings");
          services.Configure&lt;AppSettings&gt;(appSettingsSection);
          var appSettings = appSettingsSection.Get&lt;AppSettings&gt;();
  
          services.AddDbContext&lt;MuglensContext&gt;(options =&gt; options.UseSqlServer(appSettings.DBConnection));
  
          services.AddAuthentication(options =&gt;
          {
              options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
              options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
          })
          .AddJwtBearer(options =&gt;
          {
              options.RequireHttpsMetadata = false;
              options.SaveToken = true;
              options.TokenValidationParameters = new TokenValidationParameters
              {
                  ValidateIssuer = true,
                  ValidateAudience = true,
                  ValidateIssuerSigningKey = true,
                  IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(appSettings.JWTKey))
              };
          });
          // Underneath this is adding of scoped services
  </code></pre>
  
  <p>Startup.cs - Configure</p>
  
  <pre><code>    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
      {
          if (env.IsDevelopment())
          {
              app.UseDeveloperExceptionPage();
          }
  
          app.UseCors(builder =&gt; builder
              .WithOrigins(Configuration["Origins"])
              .AllowAnyHeader()
              .AllowAnyMethod()
          );
  
          //AuthAppBuilderExtensions.UseAuthentication(app);
          app.UseRouting();
          app.UseAuthentication();
          app.UseAuthorization();
  
          app.UseEndpoints(endpoints =&gt;
          {
              endpoints.MapControllers();
          });
  
      }
  </code></pre>
  
  <p>AuthService.cs - GenerateToken </p>
  
  <pre><code>    private string GenerateToken(string email, string userID)
      {
          var claims = new[]
          {
              new Claim("email", email),
              new Claim("userID", userID)
          };
  
          var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_settings.JWTKey));
          var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
  
          var token = new JwtSecurityToken(
              issuer: _settings.Origins,
              audience: _settings.Origins,
              claims: claims,
              expires: DateTime.Now.AddMinutes(45),
              signingCredentials: creds);
  
          return new JwtSecurityTokenHandler().WriteToken(token);
      }
  </code></pre>
  
  <p>Any help would be much appreciated.</p>