{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/133","labels_url":"https://api.github.com/repos/aspnet/Security/issues/133/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/133/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/133/events","html_url":"https://github.com/aspnet/Security/issues/133","id":55554136,"number":133,"title":"[Exploratory Testing] Cannot add authz for apis in a single app.","user":{"login":"harshgMSFT","id":6729943,"avatar_url":"https://avatars.githubusercontent.com/u/6729943?v=3","gravatar_id":"","url":"https://api.github.com/users/harshgMSFT","html_url":"https://github.com/harshgMSFT","followers_url":"https://api.github.com/users/harshgMSFT/followers","following_url":"https://api.github.com/users/harshgMSFT/following{/other_user}","gists_url":"https://api.github.com/users/harshgMSFT/gists{/gist_id}","starred_url":"https://api.github.com/users/harshgMSFT/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/harshgMSFT/subscriptions","organizations_url":"https://api.github.com/users/harshgMSFT/orgs","repos_url":"https://api.github.com/users/harshgMSFT/repos","events_url":"https://api.github.com/users/harshgMSFT/events{/privacy}","received_events_url":"https://api.github.com/users/harshgMSFT/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/aspnet/Security/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/aspnet/Security/milestones/4","html_url":"https://github.com/aspnet/Security/milestones/1.0.0-rc1","labels_url":"https://api.github.com/repos/aspnet/Security/milestones/4/labels","id":913789,"number":4,"title":"1.0.0-rc1","description":"","creator":{"login":"Tratcher","id":1821173,"avatar_url":"https://avatars.githubusercontent.com/u/1821173?v=3","gravatar_id":"","url":"https://api.github.com/users/Tratcher","html_url":"https://github.com/Tratcher","followers_url":"https://api.github.com/users/Tratcher/followers","following_url":"https://api.github.com/users/Tratcher/following{/other_user}","gists_url":"https://api.github.com/users/Tratcher/gists{/gist_id}","starred_url":"https://api.github.com/users/Tratcher/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Tratcher/subscriptions","organizations_url":"https://api.github.com/users/Tratcher/orgs","repos_url":"https://api.github.com/users/Tratcher/repos","events_url":"https://api.github.com/users/Tratcher/events{/privacy}","received_events_url":"https://api.github.com/users/Tratcher/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":10,"state":"open","created_at":"2014-12-23T23:47:55Z","updated_at":"2015-03-06T00:56:10Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2015-01-26T23:37:59Z","updated_at":"2015-03-15T21:58:06Z","closed_at":null,"body":"Currently if there is a thick client which targets the same service as the browser, with a custom authorization middleware,  even in case of authorization failure, the client receives a 200.(instead of a 401 or 403).\r\n\r\nThe reason is that there is no way of specifying the authentication type within the authz service. Since to enable browser based authz, cookie middleware has to be added, even if a custom middleware is added, the response gets redirected to a login page in case of a 401, which results in a 200 response getting sent back to an api based client (windows phone app).\r\n\r\nThe workaround today is either : \r\n1. Have apis and browser based app as separate end points.\r\n2. Call the cookie middleware within your custom middleware.\r\n\r\ncc: @Tratcher , @HaoK /\r\n"},"comment":{"url":"https://api.github.com/repos/aspnet/Security/issues/comments/81257490","html_url":"https://github.com/aspnet/Security/issues/133#issuecomment-81257490","issue_url":"https://api.github.com/repos/aspnet/Security/issues/133","id":81257490,"user":{"login":"HaoK","id":6537861,"avatar_url":"https://avatars.githubusercontent.com/u/6537861?v=3","gravatar_id":"","url":"https://api.github.com/users/HaoK","html_url":"https://github.com/HaoK","followers_url":"https://api.github.com/users/HaoK/followers","following_url":"https://api.github.com/users/HaoK/following{/other_user}","gists_url":"https://api.github.com/users/HaoK/gists{/gist_id}","starred_url":"https://api.github.com/users/HaoK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HaoK/subscriptions","organizations_url":"https://api.github.com/users/HaoK/orgs","repos_url":"https://api.github.com/users/HaoK/repos","events_url":"https://api.github.com/users/HaoK/events{/privacy}","received_events_url":"https://api.github.com/users/HaoK/received_events","type":"User","site_admin":false},"created_at":"2015-03-15T21:58:06Z","updated_at":"2015-03-15T21:58:06Z","body":"This should be working now"}}