title: Specifying an authentication scheme for a single route that's handled by middleware
body: <p>I have a new ASP.Net Core 3 MVC site that I've added GraphQL to with <a href="https://hotchocolate.io/" rel="nofollow noreferrer">HotChocolate</a>.  I have users signing in to the MVC side using cookie-based auth with Auth0:</p>
  
  <pre class="lang-cs prettyprint-override"><code>services.AddAuthentication(options =&gt;
          {
              options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
              options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
              options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
          })
      .AddCookie()
      .AddOpenIdConnect("Auth0", options =&gt;
          {
              ...
          });
  </code></pre>
  
  <p>But for GraphQL requests, I need JWT auth, for which I'd use:</p>
  
  <pre class="lang-cs prettyprint-override"><code>services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
      .AddJwtBearer(config =&gt;
          {
              ...
          });
  </code></pre>
  
  <p>They both independently work fine.  Cookie auth allows controller use; JWT auth allows GQL use.  But I can't figure out how to get the cookie auth for the controllers and JWT for the <code>/graphql</code> route.</p>
  
  <p><em>A little context: HotChocolate uses a custom middleware to handle requests that come in to the <code>/graphql</code> route.  It's not on a controller, so I can't just specify the scheme with the <code>Authorize</code> attribute as there isn't a controller to put it on.</em></p>
  
  <h3>Similar questions</h3>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/54776410/combining-cookie-and-token-authentication-in-asp-net-core">Combining cookie and token authentication in ASP.NET Core
  </a> - The answer here ("use a framework") is vague and fairly unhelpful.</li>
  <li><a href="https://stackoverflow.com/questions/40312503/configuring-different-authorization-authentication-schemes">Configuring different authorization/authentication schemes</a> - This is .Net Core 1.1, not 3.1.  The APIs have changed quite a bit.  Tried to adapt it, but got runtime errors saying <code>DefaultSignInScheme</code> is required.</li>
  </ul>
  
  <p>(There were a few others, mainly focused on combining REST and MVC, but these both go to controllers so the scenario is a bit different.)</p>