Protected web calls when token is not valid - jwt

Question

I use .NET Core 3
I've downloaded Microsoft.Identity.Web from https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/tree/aspnetcore3
I use Azure AD to get access to my protected web API. Recently I've switch to Core 3.0 where the issue occures (On 2.2 it worked fine).
Currently when I try to call web api with invalid token I get into
JwtBearerMiddlewareDiagnostics class method
private static async Task OnAuthenticationFailedAsync(AuthenticationFailedContext context)
{
Debug.WriteLine($"99. Begin {nameof(OnAuthenticationFailedAsync)}");
// Place a breakpoint here and examine context.Exception
await s_onAuthenticationFailed(context).ConfigureAwait(false);
Debug.WriteLine($"99. End - {nameof(OnAuthenticationFailedAsync)}");
}
which is absolutely right, since the token is invalid. But after that my protected controller methods calls anyway (I call them from postman by add header with Bearer and the token).
Here's my controller:
[Route("api/Points")]
[ApiController]
[Authorize(AuthenticationSchemes = "AzureAD")]
public class InstallationPointController : ControllerBase
{
...
}
Setup for AD authorization in Startup.cs:
services.AddProtectedWebApi(Configuration,subscribeToJwtBearerMiddlewareDiagnosticsEvents:true)
.AddProtectedApiCallsWebApis(Configuration, new []{ "user.read", "offline_access" }).AddInMemoryTokenCaches();
Update
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
else
{
// The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
app.UseHsts();
}
app.UseHttpsRedirection();
app.UseAuthentication();
app.UseAuthorization();
app.UseRouting();
app.UseEndpoints(endpoints =>
{
endpoints.MapControllers();
});
}

Answer 1

The order of your middleware is wrong. Routing needs to be before authentication and authorisation.
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
app.UseEndpoints(endpoints =>
{
endpoints.MapControllers();
});

Answer 2

One observation, I noticed that you are using the scheme value AzureAD. Currently, Microsoft.Identity.Web uses OpenIdConnectDefaults.AuthenticationScheme as a default scheme (which has OpenIdConnect as its value).
If you want to use a different scheme name with Microsoft.Identity.Web, you can use the following method:
services.AddAuthentication("MyScheme")
.AddSignIn(Configuration);