Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

EndpointMiddleware will not work if SuppressCheckForUnhandledSecurityMetadata is true

See original GitHub issue

When RouteOptions.SuppressCheckForUnhandledSecurityMetadata is set to true, EndpointMiddleware would not execute any Endpoint.

I think the reason is EndpointMiddleware must skip checking for Auth and Cors Middleware, instead of return a CompletedTask.

This is the current code

if (_routeOptions.SuppressCheckForUnhandledSecurityMetadata)
{
    // User opted out of this check.
    return Task.CompletedTask;
}

if (endpoint.Metadata.GetMetadata<IAuthorizeData>() != null &&
!httpContext.Items.ContainsKey(AuthorizationMiddlewareInvokedKey))
{
    ThrowMissingAuthMiddlewareException(endpoint);
}

if (endpoint.Metadata.GetMetadata<ICorsMetadata>() != null &&
!httpContext.Items.ContainsKey(CorsMiddlewareInvokedKey))
{
    ThrowMissingCorsMiddlewareException(endpoint);
}

I think change it to this would solve the issue

if (!_routeOptions.SuppressCheckForUnhandledSecurityMetadata)
{
    if (endpoint.Metadata.GetMetadata<IAuthorizeData>() != null &&
    !httpContext.Items.ContainsKey(AuthorizationMiddlewareInvokedKey))
    {
        ThrowMissingAuthMiddlewareException(endpoint);
    }

    if (endpoint.Metadata.GetMetadata<ICorsMetadata>() != null &&
    !httpContext.Items.ContainsKey(CorsMiddlewareInvokedKey))
    {
        ThrowMissingCorsMiddlewareException(endpoint);
    }
}