System.InvalidOperationException: No authentication handler is configured to handle the scheme: Automatic
<p>Scenario:</p>

<ol>
<li>Create a New Asp.Net Core (version 1.0.0) project</li>
<li>Choose the Web API template</li>
<li>Add the <code>[Authorize]</code> attribute on the default ValuesController</li>
<li>Run the application</li>
</ol>

<p>If I run the application with IIS and make a GET request to <code>http://localhost:60513/api/values</code> I get the expected <code>401 Unauthorized error</code></p>

<p>If however I run the application with Kestrel (e.g: <code>dotnet run</code>) and make a GET request to <code>http://localhost:5000/api/values</code> I get a <code>500 Internal Server Error</code> with the following exception at kestrel:</p>

<pre><code>Now listening on: http://localhost:5000
Application started. Press Ctrl+C to shut down.
info: Microsoft.AspNetCore.Hosting.Internal.WebHost[1]
      Request starting HTTP/1.1 GET http://localhost:5000/api/values
info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[2]
      Authorization failed for user: .
warn: Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker[1]
      Authorization failed for the request at filter 'Microsoft.AspNetCore.Mvc.Authorization.AuthorizeFilter'.
info: Microsoft.AspNetCore.Mvc.ChallengeResult[1]
      Executing ChallengeResult with authentication schemes ().
fail: Microsoft.AspNetCore.Server.Kestrel[13]
      Connection id "0HKUMMBBBQ6AU": An unhandled exception was thrown by the application.
System.InvalidOperationException: No authentication handler is configured to handle the scheme: Automatic
   at Microsoft.AspNetCore.Http.Authentication.Internal.DefaultAuthenticationManager.&lt;ChallengeAsync&gt;d__12.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Mvc.ChallengeResult.&lt;ExecuteResultAsync&gt;d__14.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.&lt;InvokeResultAsync&gt;d__32.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.&lt;InvokeAsync&gt;d__18.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Builder.RouterMiddleware.&lt;Invoke&gt;d__4.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Hosting.Internal.RequestServicesContainerMiddleware.&lt;Invoke&gt;d__3.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Server.Kestrel.Internal.Http.Frame`1.&lt;RequestProcessingAsync&gt;d__2.MoveNext()
info: Microsoft.AspNetCore.Hosting.Internal.WebHost[2]
      Request finished in 282.8427ms 200
</code></pre>

<p>My question is <strong>Why my application has different result depending on the server hosting it?</strong> Why Kestrel and IIS handle the Authorization differently?</p>

<p>Please note that there are similar questions in StackOverflow like <a href="https://stackoverflow.com/questions/33825058/no-authentication-handler-is-configured-to-handle-the-scheme-automatic">this</a> or <a href="https://stackoverflow.com/questions/38968422/no-authentication-handler-is-configured-to-handle-the-scheme">this other</a> but they all are for more complex scenarios where filters or middleware are involved.</p>

<p>I do not have any middleware in the AspNet pipeline other than MVC, and all the code but the <code>[Authorize]</code> attribute is automatically generated by the AspNet Web Api template.</p>