InvalidOperationException: No authenticationScheme was specified : Cookie-based authentication

 If you're using cookie-based authentication in ASP.NET Core and encountering the error InvalidOperationException: No authenticationScheme was specified, and there was no DefaultChallengeScheme found, it means that the authentication middleware is not properly configured. Below is how you can fix this issue for cookie-based authentication.

---

Solution: Configure Cookie Authentication in ASP.NET Core

1. Install the Required NuGet Package
   Ensure you have the Microsoft.AspNetCore.Authentication.Cookies package installed. You can add it via the NuGet Package Manager or by running the following command:

   
   

   dotnet add package Microsoft.AspNetCore.Authentication.Cookies

2. 
   

3. Configure Cookie Authentication in Program.cs (for .NET 6+)
   If you're using .NET 6 or later, update your Program.cs file:

   csharp

   Copy

   using Microsoft.AspNetCore.Authentication.Cookies;
   
   var builder = WebApplication.CreateBuilder(args);
   
   // Add services to the container.
   builder.Services.AddControllersWithViews();
   
   // Configure Cookie Authentication
   builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
       .AddCookie(options =>
       {
           options.LoginPath = "/Account/Login"; // Redirect to login page if unauthorized
           options.AccessDeniedPath = "/Account/AccessDenied"; // Redirect if access is denied
           options.ExpireTimeSpan = TimeSpan.FromMinutes(30); // Set cookie expiration time
           options.SlidingExpiration = true; // Renew the cookie if more than half the time has passed
       });
   
   // Add Authorization
   builder.Services.AddAuthorization();
   
   var app = builder.Build();
   
   // Configure the HTTP request pipeline.
   if (!app.Environment.IsDevelopment())
   {
       app.UseExceptionHandler("/Home/Error");
       app.UseHsts();
   }
   
   app.UseHttpsRedirection();
   app.UseStaticFiles();
   app.UseRouting();
   
   // Enable Authentication and Authorization
   app.UseAuthentication();
   app.UseAuthorization();
   
   app.MapControllerRoute(
       name: "default",
       pattern: "{controller=Home}/{action=Index}/{id?}");
   
   app.Run();

4. 
   

5. Configure Cookie Authentication in Startup.cs (for .NET 5 or earlier)
   If you're using .NET 5 or earlier, update your Startup.cs file:

   csharp

   Copy

   using Microsoft.AspNetCore.Authentication.Cookies;
   
   public class Startup
   {
       public IConfiguration Configuration { get; }
   
       public Startup(IConfiguration configuration)
       {
           Configuration = configuration;
       }
   
       public void ConfigureServices(IServiceCollection services)
       {
           services.AddControllersWithViews();
   
           // Configure Cookie Authentication
           services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
               .AddCookie(options =>
               {
                   options.LoginPath = "/Account/Login"; // Redirect to login page if unauthorized
                   options.AccessDeniedPath = "/Account/AccessDenied"; // Redirect if access is denied
                   options.ExpireTimeSpan = TimeSpan.FromMinutes(30); // Set cookie expiration time
                   options.SlidingExpiration = true; // Renew the cookie if more than half the time has passed
               });
   
           // Add Authorization
           services.AddAuthorization();
       }
   
       public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
       {
           if (env.IsDevelopment())
           {
               app.UseDeveloperExceptionPage();
           }
           else
           {
               app.UseExceptionHandler("/Home/Error");
               app.UseHsts();
           }
   
           app.UseHttpsRedirection();
           app.UseStaticFiles();
           app.UseRouting();
   
           // Enable Authentication and Authorization
           app.UseAuthentication();
           app.UseAuthorization();
   
           app.UseEndpoints(endpoints =>
           {
               endpoints.MapControllerRoute(
                   name: "default",
                   pattern: "{controller=Home}/{action=Index}/{id?}");
           });
       }
   }

6. 
   

7. Use Authentication in Your Controllers
   To enforce authentication for specific controllers or actions, use the [Authorize] attribute:

   csharp

   Copy

   [Authorize] // Requires authentication for all actions in this controller
   public class HomeController : Controller
   {
       public IActionResult Index()
       {
           return View();
       }
   
       [AllowAnonymous] // Allows anonymous access to this action
       public IActionResult PublicPage()
       {
           return View();
       }
   }

8. 
   

9. Login and Logout Actions
   Implement login and logout actions to issue and remove authentication cookies. For example:

   csharp

   Copy

   public class AccountController : Controller
   {
       [AllowAnonymous]
       public IActionResult Login()
       {
           return View();
       }
   
       [HttpPost]
       [AllowAnonymous]
       public async Task<IActionResult> Login(string username, string password)
       {
           // Validate username and password (e.g., check against a database)
           if (username == "admin" && password == "password")
           {
               var claims = new List<Claim>
               {
                   new Claim(ClaimTypes.Name, username)
               };
   
               var identity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
               var principal = new ClaimsPrincipal(identity);
   
               await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, principal);
   
               return RedirectToAction("Index", "Home");
           }
   
           ViewBag.Error = "Invalid username or password";
           return View();
       }
   
       public async Task<IActionResult> Logout()
       {
           await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
           return RedirectToAction("Login");
       }
   }

---

Key Points to Remember

• 
  

• Order of Middleware: Always call app.UseAuthentication() before app.UseAuthorization() in the middleware pipeline.

• 
  

• Default Scheme: The AddAuthentication method sets the default authentication scheme to CookieAuthenticationDefaults.AuthenticationScheme.

• 
  

• Login and Logout: Use HttpContext.SignInAsync to issue a cookie and HttpContext.SignOutAsync to remove it.

---

This should resolve the InvalidOperationException and properly configure cookie-based authentication in your ASP.NET Core application.