title: ASP.NET.Core allow anonymous access to OData $metadata when RequireAuthenticatedUser() is set
body: <p>I have an <strong><code>ASP.NET Core 2.1</code></strong> site that has the following in the <code>WebApiConfig</code> file:</p>
  
  <pre><code> services.AddMvc(config =&gt;
              {
                  // Force authorization for all controllers
                  var policy = new AuthorizationPolicyBuilder()
                      .RequireAuthenticatedUser()
                      .Build();
                  config.Filters.Add(new AuthorizeFilter(policy));
              })
  </code></pre>
  
  <p>This forces all callers to authenticate before calling any of the controllers.
  Unfortunately, this also forces user authentication to access the OData "$metadata" URL.</p>
  
  <p>Is there a way to allow anonymous access to the metadata page?</p>
  
  <p>Note: this is the same question as below (but for .NET Core)</p>
  
  <p><a href="https://stackoverflow.com/questions/35894875/asp-net-allow-anonymous-access-to-odata-metadata-when-site-has-global-authorize">ASP.NET allow anonymous access to OData $metadata when site has global AuthorizeAttribute</a></p>