title: ASP.NET Core - getting a message from AuthenticateResult.Fail
body: <p>Can not get an error message in HTTP response.</p>
  <pre><code>            if (!string.IsNullOrWhiteSpace(checkTokenResponse.Error))
              {
                  Logger.LogError(checkTokenResponse.Error);
                  return AuthenticateResult.Fail(checkTokenResponse.Error);
              }
  </code></pre>
  <p>response</p>
  <p><a href="https://i.stack.imgur.com/isXvE.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/isXvE.png" alt="enter image description here" /></a></p>
  <p>I suppose the error message should render into <em>data</em> response field
  The same question <a href="https://stackoverflow.com/questions/55834452/asp-net-core-getting-a-message-back-from-authenticationhandler">ASP.NET Core - getting a message back from AuthenticationHandler</a></p>
  <p><strong>Update</strong></p>
  <p>code of custom Auth handler</p>
  <pre><code>public class AuthHandler : AuthenticationHandler&lt;AuthOptions&gt;
  {
      private readonly IPrimeApiProxy _primeApiProxy;
      private readonly IPrimeProxy _primeProxy;
      private readonly int _adminGroupId;
  
      private static readonly string HeaderName = &quot;Authorization&quot;;
      private static readonly string ApiAuthScheme = &quot;oauth &quot;;
  
      public AuthHandler(
          IOptionsMonitor&lt;AuthOptions&gt; options,
          ILoggerFactory logger,
          UrlEncoder encoder,
          ISystemClock clock,
          IPrimeApiProxy primeApiProxy,
          IPrimeProxy primeProxy,
          ApplicationSettingsProvider settings)
          : base(options, logger, encoder, clock)
      {
          _primeApiProxy = primeApiProxy ?? throw new ArgumentNullException(nameof(primeApiProxy));
          _primeProxy = primeProxy ?? throw new ArgumentNullException(nameof(primeProxy));
  
          _adminGroupId = int.Parse((settings as dynamic).AdminGroupId as string);
      }
  
  
      protected override async Task&lt;AuthenticateResult&gt; HandleAuthenticateAsync()
      {
          Logger.LogTrace(&quot;HandleAuthenticateAsync&quot;);
  
          if (!Request.Headers.ContainsKey(&quot;Authorization&quot;))
          {
              return AuthenticateResult.Fail(&quot;Missing Authorization Header&quot;);
          }
  
          try
          {
              var token = FetchToken(Request);
  
              if (string.IsNullOrWhiteSpace(token.token) &amp;&amp; token.userId &lt; 1)
              {
                  Logger.LogError(&quot;Invalid token&quot;);
                  return AuthenticateResult.Fail(&quot;Invalid token&quot;);
              }
  
              var checkTokenResponse = await _primeProxy.CheckToken(token.token);
  
              if (!string.IsNullOrWhiteSpace(checkTokenResponse.Error))
              {
                  Logger.LogError(checkTokenResponse.Error);
                  return AuthenticateResult.Fail(checkTokenResponse.Error);
              }
  
              var isValidInt = int.TryParse(checkTokenResponse.UserId, out var userId);
  
              if (!isValidInt)
              {
                  return AuthenticateResult.Fail(&quot;User Id is invalid&quot;);
              }
  
              if (token.userId != userId)
              {
                  return AuthenticateResult.Fail(&quot;The token belongs to another user&quot;);
              }
  
              bool isUserAdminAndCustomGroupMember = false;
              
              if (checkTokenResponse.UserRole == &quot;admin&quot;)
              {
                  isUserAdminAndCustomGroupMember = await _primeApiProxy.IsGroupMember(token.token, token.userId, _adminGroupId);
              }
  
              var claims = new List&lt;Claim&gt;()
              {
                  new Claim(ClaimTypes.NameIdentifier, token.userId.ToString()),
                  new Claim(ClaimTypes.Role, isUserAdminAndCustomGroupMember ? &quot;Admin&quot; : &quot;Learner&quot;)
              };
  
              var identity = new ClaimsIdentity(claims, Scheme.Name);
              var principal = new ClaimsPrincipal(identity);
              var ticket = new AuthenticationTicket(principal, Scheme.Name);
  
              return AuthenticateResult.Success(ticket);
          }
          catch (Exception ex)
          {
              Logger.LogError(ex, &quot;Auth exception&quot;);
              return AuthenticateResult.Fail(&quot;Invalid Authorization Header&quot;);
          }
      }
  
      private static (string token, int userId) FetchToken(HttpRequest request)
      {
          string authHeader = request.Headers[HeaderName];
  
          if (authHeader != null &amp;&amp; authHeader.StartsWith(ApiAuthScheme, StringComparison.OrdinalIgnoreCase))
          {
              string token = authHeader.Substring(ApiAuthScheme.Length).Trim();
              string[] parts = token.Split(',', StringSplitOptions.RemoveEmptyEntries);
  
              if (int.TryParse(parts[1], out int userId))
              {
                  return (parts[0], userId);
              }
          }
  
          return (null, 0);
      }
  }
  </code></pre>