title: .Net Core 2.0 Authorization always returning 401
body: <p>After adding <code>[Authorize]</code> to a controller, I'm always getting a 401 from it. While debugging, I see the <code>return AuthenticateResult.Success</code> being reached, but the code of the controller never is.<br>
  What am I doing wrong?</p>
  
  <p>Below is the code for my Startup class and Custom auth classes.</p>
  
  <hr>
  
  <pre><code>public class Startup
  {
      public void ConfigureServices(IServiceCollection services)
      {
          // ...
  
          services.AddCors(options =&gt;
          {
              options.AddPolicy("CorsPolicy", builder =&gt; builder
                  .AllowAnyHeader()
                  .AllowAnyMethod()
                  .AllowAnyOrigin()
                  .AllowCredentials());
          });
  
          services.Configure&lt;MvcOptions&gt;(options =&gt;
          {
              options.Filters.Add(new RequireHttpsAttribute());
          });
  
          services.AddAuthentication(options =&gt;
          {
              options.DefaultAuthenticateScheme = "Custom Scheme";
              options.DefaultChallengeScheme = "Custom Scheme";
          }).AddCustomAuth(o =&gt; { });
  
          services.AddMvc();
      }
  
      public void Configure(IApplicationBuilder app, IHostingEnvironment env)
      {
          app.UseCors("CorsPolicy");
  
          var options = new RewriteOptions().AddRedirectToHttps();
          app.UseRewriter(options);
  
          app.UseAuthentication();
  
          app.UseMvc();
      }
  }
  </code></pre>
  
  <hr>
  
  <pre><code>public class CustomAuthOptions : AuthenticationSchemeOptions
  {
      public ClaimsIdentity Identity { get; set; }
  
      public CustomAuthOptions()
      {
  
      }
  }
  
  public static class CustomAuthExtensions
  {
      public static AuthenticationBuilder AddCustomAuth(this AuthenticationBuilder builder, Action&lt;CustomAuthOptions&gt; configureOptions)
      {
          return builder.AddScheme&lt;CustomAuthOptions, CustomAuthHandler&gt;("Custom Scheme", "Custom Auth", configureOptions);
      }
  }
  
  internal class CustomAuthHandler : AuthenticationHandler&lt;CustomAuthOptions&gt;
  {
      public CustomAuthHandler(IOptionsMonitor&lt;CustomAuthOptions&gt; options, ILoggerFactory logger, UrlEncoder encoder, ISystemClock clock) : base(options, logger, encoder, clock)
      {
  
      }
  
      protected override async Task&lt;AuthenticateResult&gt; HandleAuthenticateAsync()
      {
          string token = Request.Headers["Authorization"];
          if (string.IsNullOrEmpty(token))
              return AuthenticateResult.Fail("Failing string");
  
          // Using external service to validate token and get user id
          int Id = GetUserId(token);
  
          return AuthenticateResult.Success(
              new AuthenticationTicket(
                  new ClaimsPrincipal(
                      new ClaimsIdentity(
                          new List&lt;Claim&gt;() { new Claim(ClaimTypes.Sid, Id.ToString()) })),
                          Scheme.Name));
      }
  }
  </code></pre>