Middleware Ordering
Problem
- Your ASP.NET Core API registers authorization middleware before authentication middleware in the request pipeline.
- A request arrives with a completely valid login token.
- Authorization runs first, finds no identity to check yet, and rejects the request as unauthorized, even though the token was fine.
A check that runs before its answer exists always fails.
Solution
Middleware Ordering
- Move authentication middleware so it runs first in the pipeline.
- Authentication reads the token and attaches the caller's identity to the request.
- Authorization now runs second, checks that identity against the rule, and lets the valid request through.
Middleware only sees what already ran before it. That's middleware ordering: sequence decides what each step can see.
Analogy
A bouncer at a members-only lounge checks a guest's ID first, then checks the guest list for that name.
If he checked the guest list before ever looking at an ID, he wouldn't know whose name to look for. Every guest would get turned away, member or not.
Middleware ordering is checking ID before checking the list, not after.
