title: ASP.NET Core 3 mock authorization during integration testing
body: <p>I am using ASP.NET core to build an API, and I am trying to upgrade from .NET core 2.2 to .NET core 3.1.</p>
  
  <p>I am using the <code>[Authorize]</code> attribute to secure the API endpoints and I want to bypass it during integration tests.</p>
  
  <p>I have managed to to create a custom AuthenticationHandler that authenticates a fake user, and an authorization handler that authorizes anybody (including anonymous users).</p>
  
  <p>My problem is that the user injected in the Authentication handler is not propagated to the Authorization handler and the filter <code>DenyAnonymousAuthorizationRequirement</code> fails
  because the User in the context is null.</p>
  
  <p>Has anyone dealt with something similar? </p>
  
  <p>By the way, the class <code>DenyAnonymousAuthorizationRequirement</code> is a Microsoft class, I copied the code as it appeared in the IDE just for the post here.</p>
  
  <p>My custom AuthenticationHandler:</p>
  
  <pre><code>  public class TestAuthHandler : AuthenticationHandler&lt;AuthenticationSchemeOptions&gt;
    {
          public TestAuthHandler(IOptionsMonitor&lt;AuthenticationSchemeOptions&gt; options,
                                 ILoggerFactory logger,
                                 UrlEncoder encoder,
                                 ISystemClock clock)
              : base(options, logger, encoder, clock) { }
  
          protected override Task&lt;AuthenticateResult&gt; HandleAuthenticateAsync()
          {
              ClaimsPrincipal fakeUser = FakeUserUtil.FakeUser();
              var ticket = new AuthenticationTicket(fakeUser, "Test");
              var result = AuthenticateResult.Success(ticket);
              return Task.FromResult(result);
          }
    }
  </code></pre>
  
  <p>The AuthorizationRequirement:</p>
  
  <pre><code>public class DenyAnonymousAuthorizationRequirement : AuthorizationHandler&lt;DenyAnonymousAuthorizationRequirement&gt;, IAuthorizationRequirement
      {
  
          protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, DenyAnonymousAuthorizationRequirement requirement)
          {
              var user = context.User;
              var userIsAnonymous =
                  user?.Identity == null ||
                  !user.Identities.Any(i =&gt; i.IsAuthenticated);
              if (!userIsAnonymous)
              {
                  context.Succeed(requirement);
              }
              return Task.CompletedTask;
          }
      }
  </code></pre>
  
  <p>The code in the ConfigureServices method that uses the above classes:</p>
  
  <pre><code> public void ConfigureServices(IServiceCollection services)
   {
  
              services.AddAuthentication("Test")
                      .AddScheme&lt;AuthenticationSchemeOptions, TestAuthHandler&gt;("Test", null);
              services.AddAuthorization(configure =&gt;
              {
                  var builder = new AuthorizationPolicyBuilder(new List&lt;string&gt; {"Test"}.ToArray())
                      .AddRequirements(new DenyAnonymousAuthorizationRequirement());
                  configure.DefaultPolicy = builder.Build();
              });
              services.AddControllers()
                      .SetCompatibilityVersion(CompatibilityVersion.Version_3_0)
                      .AddNewtonsoftJson(options =&gt;
                                             options.SerializerSettings.ReferenceLoopHandling =
                                                 ReferenceLoopHandling.Ignore);
  
  }
  </code></pre>