title: ASP.Net Core 2.1/WebAPI app: "HTTP 404 not found" calling a REST url with [Authorize]
body: <p>I'm working through a "hello world" tutorial on Asp.Net Core.  I'm using WebApi (not MVC).</p>
  
  <p>Here is the controller for the REST API I'm trying to invoke:</p>
  
  <pre><code>...
  [Authorize]
  [Route("api/[controller]")]
  [ApiController]
  
  public class ManageCarController : ControllerBase
  {
      private IMapper mapper;
      private ApplicationDbContext dbContext;
  
      public ManageCarController(IMapper mapper, ApplicationDbContext dbContext)
      {
          this.mapper = mapper;
          this.dbContext = dbContext;
      }
  
      // GET api/values
      [HttpGet]
      public IEnumerable&lt;CarViewModel&gt; Get()
      {
          IEnumerable&lt;CarViewModel&gt; list =
              this.mapper.Map&lt;IEnumerable&lt;CarViewModel&gt;&gt;(this.dbContext.cars.AsEnumerable());
      return list;
  }
  ...
  </code></pre>
  
  <p>Here is my controller for Login:</p>
  
  <pre><code>...
  [Authorize]
  [Route("[controller]/[action]")]
  public class AccountController : Controller
  {
      private readonly UserManager&lt;ApplicationUser&gt; _userManager;
      private readonly SignInManager&lt;ApplicationUser&gt; _signInManager;
      private readonly ILogger _logger;
  
      public AccountController(
          UserManager&lt;ApplicationUser&gt; userManager,
          SignInManager&lt;ApplicationUser&gt; signInManager,
          ILogger&lt;AccountController&gt; logger)
      {
          _userManager = userManager;
          _signInManager = signInManager;
          _logger = logger;
      }
  
      [TempData]
      public string ErrorMessage { get; set; }
      [HttpPost]
      [AllowAnonymous]
      public async Task&lt;IActionResult&gt; Login([FromBody]LoginViewModel model)
      {
          if (ModelState.IsValid)
          {
              // This doesn't count login failures towards account lockout
              // To enable password failures to trigger account lockout, set lockoutOnFailure: true
              var result = await _signInManager.PasswordSignInAsync
                  (model.Email, model.Password, model.RememberMe, lockoutOnFailure: false);
              if (result.Succeeded)
              {
                  var msg = "User logged in.";
                  return Ok(msg);
              }
          }
          // If we got this far, something failed, redisplay form
          return BadRequest("Fail to login with this account");
      }
  </code></pre>
  
  <p>I can log in (<code>http://localhost:5000/Login</code>) OK, the response is "User logged in."</p>
  
  <p>When I browse to <code>http://localhost:5000/api/ManageCar</code>, it redirects here and gives me an HTTP 404: <code>https://localhost:44342/Account/Login?ReturnUrl=%2Fapi%2FManageCar</code>, and I never hit the controller.</p>
  
  <p>If I comment out <code>[Authorize]</code>, then <code>http://localhost:5000/api/ManageCar</code> works OK.</p>
  
  <p>Q: What am I missing?</p>
  
  <p>Q: More important, what is a good way to troubleshoot the problem?</p>
  
  <p>Q: What (if any) additional information should I provide?</p>
  
  <p>Thank you in advance!</p>
  
  <hr>
  
  <p>UPDATE:</p>
  
  <ol>
  <li><p>Prior to calling <code>http://localhost:5000/api/ManageCar</code>, I first log in (successfully).</p></li>
  <li><p>Here is what I see in Edge > Developer Tools > Network:</p>
  
  <pre><code>Name    Protocol    Method  Result  Content type    Received    Time    Initiator
  https://localhost:44342/Account/Login   HTTP/2  POST    200 application/json        9.31 s  XMLHttpRequest
    &lt;= Login: OK
  https://localhost:44342/Account/Login   HTTPS   GET 200     (from cache)    0 s 
    &lt;= ManageCars (GET@1): OK
  https://localhost:44342/api/ManageCar   HTTP/2  GET 302     0 B 97.43 ms    XMLHttpRequest
    &lt;= ManageCars (GET@2 - 302 redirect to REST API): OK
  https://localhost:44342/Account/Login?ReturnUrl=%2Fapi%2FManageCar  HTTP/2  GET 404     0 B 16.77 ms    XMLHttpRequest
    &lt;= ManageCars (GET@3 - 404: not found): FAILS
       - Console:
  HTTP 404: NOT FOUND - The server has not found anything matching the requested URI (Uniform Resource Identifier).
  (XHR)GET - https://localhost:44342/Account/Login?ReturnUrl=%2Fapi%2FManageCar
  </code></pre></li>
  </ol>
  
  <hr>
  
  <p>CLARIFICATION FOR Tân Nguyễn's RESPONSE:</p>
  
  <ol>
  <li>I have a REST API, written in C# using Asp.Net Core 2.1 + Web API. </li>
  <li>The API has a "GET" method, <code>/api/ManageCar</code>.  If I call with without [Authorize], it works. </li>
  <li>I'm "securing" the API with <a href="https://docs.microsoft.com/en-us/aspnet/core/security/authentication/identity?view=aspnetcore-2.1&amp;tabs=visual-studio" rel="nofollow noreferrer">Asp.Net Core Identity</a>.  The URL is '/Account/Login'.  It needs to use POST (to pass username and password).  That works, too.  </li>
  <li>If I annotate "ManageCar" with [Authorize], and then log in (successfully), then <em>THEN</em> GET <code>/api/ManageCar</code> ... it DOESN'T go directly to my controller for "/api/ManageCar".</li>
  <li>Instead, it goes to "/Account/Login" (I'm already logged in, the result is HTTP 200), then redirects to "<a href="https://localhost:44342/Account/Login?ReturnUrl=%2Fapi%2FManageCar" rel="nofollow noreferrer">https://localhost:44342/Account/Login?ReturnUrl=%2Fapi%2FManageCar</a>"/</li>
  <li>I <em>should</em> be able to do a POST for my login, and a GET for my (now authenticated) query - it <em>should</em> "just work".</li>
  <li>Unfortunately, I don't know what Asp.Net is doing "behind the scenes" ... and I don't know what's causing the problem, or how to fix it.</li>
  </ol>
  
  <hr>
  
  <p>UPDATE</p>
  
  <ol>
  <li><p>I still haven't resolved the problem - I'm still getting HTTP 404 with <code>[Authorize]</code>, and it works without <code>[Authorize]</code></p></li>
  <li><p>Both my AccountController and ManageCarController have the same path: <code>[Route("api/[controller]/[action])]' and</code>[Route("api/[controller])]`, respectively.  I can still log in successfully, I still get HTTP 404 when I try to read the "Cars" list.</p></li>
  <li><p>I enabled "Trace" logging in my <code>appsettings.json</code>.  Here is a summary of the output of the failed API call:</p>
  
  <pre><code>Console log:
  - Request starting HTTP/1.1 GET http://localhost:63264/api/ManageCar  
    Request finished in 81.994ms 302
  - Request starting HTTP/1.1 GET http://localhost:63264/Account/Login?ReturnUrl=%2Fapi%2FManageCar 
    AuthenticationScheme: Identity.Application was successfully authenticated.
    The request path /Account/Login does not match a supported file type
    The request path  does not match the path filter
    Request finished in 31.9471ms 404
    SUMMARY:
    a) request to "ManageCar" redirects to AccountController =&gt; OK
    b) AccountController gets the request =&gt; OK
    c) Q: Does AccountController authenticate the request? 
       &lt;= it *seems* to ("successfully authenticated"...)
    d) Q: What do "match a supported file type" or "match the path filter" mean?  
          What can I do about them?
  </code></pre></li>
  </ol>