endpoints.MapControllerRoute() 上的 RequireAuthorization() 不起作用，每个请求都通过

Question

我在 Asp.Net Core 3.1 中有以下代码

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
            options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
        }).AddJwtBearer();
}

public void Configure(IApplicationBuilder app, IWebHostEnvironment env, ILoggerFactory loggerFactory)
{
    app.UseRouting();

    app.UseCors(DefaultCorsPolicyName);

    app.UseAuthentication();
    app.UseAuthorization();

    app.UseEndpoints(endpoints =>
    {
    endpoints.MapControllerRoute("default", "{controller}/{action}/{id?}").RequireAuthorization(new AuthorizeAttribute());
    });
}


[ApiController]
[Route("[controller]/[action]")]
public class TestController : ControllerBase
{
    [HttpGet]
    public string Test()
    {
        return "Test works!";
    }
}

但所有请求都通过并且没有授权工作。知道为什么会这样吗？

Answer 1

添加endpoints.MapControllers().RequireAuthorization(...);到您的端点配置中。

您的控制器具有自己的/显式Route属性，并且不在MapControllerRoute调用范围内。