Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

`FallbackPolicy` runs even when service or operation has `AuthorizeAttribute` applied

See original GitHub issue

Per docs and testing with WebAPI controllers, FallbackPolicy should only run when the action does not have any IAuthorizeData attributes (Authorize or AllowAnonymous) applied. With CoreWCF, FallbackPolicy applies unconditionally (more like DefaultPolicy).

Example:

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddServiceModelServices();
builder.Services.AddAuthentication().AddFakeJwt();
builder.Services.AddAuthorization(opts =>
{
    opts.FallbackPolicy = new AuthorizationPolicyBuilder().RequireAssertion(hc => false).Build();
    opts.AddPolicy("Anonymous", policy => policy.RequireAssertion(hc => true));
});

var app = builder.Build();

app.UseRouting();

app.UseAuthentication();
app.UseAuthorization();

app.UseServiceModel(c =>
{
    c.AddService<WcfService>()
        .AddServiceEndpoint<WcfService, IWcfService>(new BasicHttpBinding
        {
            Security = new BasicHttpSecurity
            {
                Mode = BasicHttpSecurityMode.Transport,
                Transport = new HttpTransportSecurity
                {
                    ClientCredentialType = HttpClientCredentialType.InheritedFromHost
                }
            }
        }, "/IWcfService");
});

app.Run();

[ServiceContract(Namespace = "urn:example")]
public interface IWcfService
{
    [OperationContract]
    void Hello();
}

[Authorize(Policy = "Anonymous")]
public class WcfService : IWcfService
{
    public void Hello()
    {
        Console.WriteLine("Example 2");
    }
}

Request:

POST https://localhost:7160/IWcfService HTTP/1.1
Content-Type: text/xml; Charset=UTF-8
User-Agent: XML Spy
SOAPAction: "urn:example/IWcfService/Hello"
Host: localhost:7160
Content-Length: 126
Connection: Keep-Alive
Cache-Control: no-cache

<Envelope xmlns="http://schemas.xmlsoap.org/soap/envelope/">
	<Body>
		<Hello xmlns="urn:example"/>
	</Body>
</Envelope>

Expected behavior: Only "Anonymous" policy assertion is executed and call completes Actual behavior: Both policies are executed and authorization results in access denied

Versions: .Net 7, CoreWCF.Http 1.3.1