title: How to return custom message from custom AuthorizeAttribute?
body: <p>I am using ASP.NET Core 3.1 WebAPI with Auth0.</p>
  <p>I wanted to implement a custom <code>AuthorizeAttribute</code> that would perform simple permission checks and return 403 with a message if permissions are missing.</p>
  <p>Here is the code:</p>
  <p><code>Startup.cs</code> (ConfigureServices)</p>
  <pre><code>services
          .AddAuthentication(options =&gt;
              {
                  options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                  options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
              }
          )
          .AddJwtBearer(options =&gt;
              {
                  var keyResolver = new MultipleIssuerSigningKeyResolver();
                  options.MetadataAddress = &quot;https://.../.well-known/openid-configuration&quot;;
                  options.TokenValidationParameters = new TokenValidationParameters
                  {
                      ValidAudience = Auth0Configuration.Audience,
                      ValidIssuers = Auth0Configuration.Issuers,
                      IssuerSigningKeyResolver = (token, securityToken, kid, parameters) =&gt;
                          keyResolver.GetSigningKey(securityToken.Issuer, kid)
                  };
              }
          );
  </code></pre>
  <p>Custom <code>AuthorizeAttribute</code>:</p>
  <pre><code>public class AuthorizeAttribute : Microsoft.AspNetCore.Authorization.AuthorizeAttribute, IAsyncAuthorizationFilter
  {
      private readonly string[] _permissions;
  
      public AuthorizeAttribute(params string[] permissions)
      {
          _permissions = permissions;
      }
  
      /// &lt;inheritdoc /&gt;
      public async Task OnAuthorizationAsync(AuthorizationFilterContext context)
      {
          var user = (IRemoteUser) context.HttpContext.RequestServices.GetService(typeof(IRemoteUser));
          await user.Fetch(context.HttpContext);
          context.HttpContext.Items[&quot;RemoteUser&quot;] = user;
          foreach (var permission in _permissions)
          {
              if (user.HasPermission(permission)) continue;
  
              // Permission not found, return forbidden.
              context.Result = new ForbidResult($&quot;Permission '{permission}' is required.&quot;);
              return;
          }
      }
  }
  </code></pre>
  <p>I call it like this:</p>
  <pre><code>[Authorize(&quot;support:all&quot;)]
  [HttpPost]
  public async Task&lt;ActionResult&gt; Create([FromBody] SupportMessageCreateDto dto)
  {...}
  </code></pre>
  <p>It works fine if I don't provide a message to <code>new ForbidResult()</code>. I get 403 if permission is missing. But if I provide this message, I get:</p>
  <pre><code>{
    &quot;error&quot;: &quot;No authentication handler is registered for the scheme 'Permission 'support:all' is required.'. The registered schemes are: Bearer. Did you forget to call AddAuthentication().Add[SomeAuthHandler](\&quot;Permission 'support:all' is required.\&quot;,...)?&quot;
  }
  </code></pre>
  <p>Why is this happening and how can I solve it?  I really like this setup as it is simple, but this message is required.</p>