title: ASP.NET Core 2.0 disable automatic challenge
body: <p>After upgrading my ASP.NET Core project to 2.0, attempts to access protected endpoints no longer returns 401, but redirects to an (non-existing) endpoint in an attempt to let the user authenticate.</p>
  
  <p>The desired behaviour is for the application simply to return a 401. Previously I would set <code>AutomaticChallenge = false</code> when configuring authentication, but according to <a href="https://docs.microsoft.com/en-us/aspnet/core/security/authentication/cookie?tabs=aspnetcore2x" rel="noreferrer">this article</a> the setting is no longer relevant (in fact it doesn't exist anymore).</p>
  
  <p>My authentication is configured like this:</p>
  
  <p>Startup.cs.ConfigureServices():</p>
  
  <pre><code>services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
                  .AddCookie(o =&gt;
                  {
                      o.Cookie.Name = options.CookieName;
                      o.Cookie.Domain = options.CookieDomain;
                      o.SlidingExpiration = true;
                      o.ExpireTimeSpan = options.CookieLifetime;
                      o.TicketDataFormat = ticketFormat;
                      o.CookieManager = new CustomChunkingCookieManager();
                  });
  </code></pre>
  
  <p>Configure():</p>
  
  <pre><code>app.UseAuthentication();
  </code></pre>
  
  <p>How can I disable automatic challenge, so that the application returns 401 when the user is not authenticated?</p>