A challenge response means a request failed authorization because the user is not authenticated. AuthorizationMiddleware stops the request instead of executing the protected endpoint. section 24.2.2
Separate a challenge from the other authorization outcomes:
- Challenge: the user has not logged in and must authenticate. section 24.2.2
- Forbid: the user is authenticated but lacks a required authorization condition, such as a claim. section 24.2.2
- Success: the request passes through authorization and the endpoint executes. section 24.2.2
Cookie-authenticated web application
When a user requests a protected Razor Page without authentication, a cookie-authentication challenge redirects the user to the application’s login page. After logging in, the user can try the protected resource again. section 24.2.2
Figure 24.3 The three types of response to an authorization attempt. In the left example, the request contains an authentication cookie, so the user is authenticated in the AuthenticationMiddleware. The AuthorizationMiddleware confirms that the authenticated user can access the selected endpoint, so the endpoint is executed. In the center example, the request is not authenticated, so the Authorization-Middleware generates a challenge response. In the right example, the request is authenticated, but the user does not have permission to execute the endpoint, so a forbid response is generated.
Compare successful authorization, a challenge for an unauthenticated request, and a forbid response for an authenticated user without permission. section 24.2.2
