BLOG.

The API Had No Lock: Finding an ASP.NET Core Auth Hole in My Own App→︎

app.UseAuthentication() was never called and no API controller had [Authorize]. The whole JSON API was open to anyone. Here's how I found it, and what it actually took to fix it without breaking the app.