{"record":{"id":"726246468c8e928a","repo":"dotnet/aspnetcore","slug":"the-authorization-data-specifies-an-authentication","errorCode":null,"errorMessage":"The authorization data specifies an authentication scheme with value '{0}'. Authentication schemes cannot be specified for components.","messagePattern":"The authorization data specifies an authentication scheme with value '(.+?)'\\. Authentication schemes cannot be specified for components\\.","errorType":"exception","errorClass":"NotSupportedException","httpStatus":null,"severity":"error","filePath":"src/Components/Authorization/src/AuthorizeViewCore.cs","lineNumber":135,"sourceCode":"        {\n            // The metadata contained nothing that contributes to a policy.\n            return true;\n        }\n\n        var result = await AuthorizationService.AuthorizeAsync(user, Resource, policy);\n        return result.Succeeded;\n    }\n\n    private static void EnsureNoAuthenticationSchemeSpecified(object[] metadata)\n    {\n        // It's not meaningful to specify a nonempty scheme, since by the time Components\n        // authorization runs, we already have a specific ClaimsPrincipal (we're stateful).\n        // To avoid any confusion, ensure the developer isn't trying to specify a scheme.\n        for (var i = 0; i < metadata.Length; i++)\n        {\n            if (metadata[i] is IAuthorizeData entry && !string.IsNullOrEmpty(entry.AuthenticationSchemes))\n            {\n                throw new NotSupportedException($\"The authorization data specifies an authentication scheme with value '{entry.AuthenticationSchemes}'. Authentication schemes cannot be specified for components.\");\n            }\n        }\n    }\n}\n","sourceCodeStart":117,"sourceCodeEnd":140,"githubUrl":"https://github.com/dotnet/aspnetcore/blob/294cab2f9b2e03af6b953820c7ab497c3c8b7ad9/src/Components/Authorization/src/AuthorizeViewCore.cs#L117-L140","documentation":"Thrown as a NotSupportedException by AuthorizeViewCore.EnsureNoAuthenticationSchemeSpecified when any IAuthorizeData entry in the authorization metadata has a non-empty AuthenticationSchemes value. Blazor component authorization is stateful — by the time it runs, the framework already holds a specific ClaimsPrincipal from the AuthenticationStateProvider, so selecting an authentication scheme is meaningless and explicitly disallowed.","triggerScenarios":"Specifying an AuthenticationSchemes property on [Authorize] attribute used in a Blazor component or page (e.g., [Authorize(AuthenticationSchemes = \"Bearer\"]) applied to a Razor component). The loop at AuthorizeViewCore.cs:131-137 inspects all metadata entries.","commonSituations":"Porting MVC/controller-based [Authorize(AuthenticationSchemes = ...)] attributes to Blazor pages; using shared authorization policy objects that include scheme configuration in a Blazor context.","solutions":["Remove the AuthenticationSchemes property from any [Authorize] attribute applied to Blazor components or pages.","If you need scheme-specific auth, handle it at the authentication/SignIn level (configure the AuthenticationStateProvider) rather than in component authorization metadata.","Use role-based or policy-based authorization instead: [Authorize(Roles = \"...\")] or [Authorize(Policy = \"...\")]."],"exampleFix":"// before\n@attribute [Authorize(AuthenticationSchemes = \"Bearer\")]\n\n// after\n@attribute [Authorize(Policy = \"MyPolicy\"]","handlingStrategy":"validation","validationCode":"// Validate authorize data before passing to components\nforeach (var entry in authorizeData.OfType<IAuthorizeData>())\n{\n    if (!string.IsNullOrEmpty(entry.AuthenticationSchemes))\n        throw new NotSupportedException(\"Do not set AuthenticationSchemes on component-level [Authorize].\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never use AuthenticationSchemes in [Authorize] on Blazor components/pages.","Reserve scheme selection for middleware/endpoint configuration, not component metadata."],"tags":["blazor","authorization","authentication-scheme","configuration"],"analyzedSha":"294cab2f9b2e03af6b953820c7ab497c3c8b7ad9","analyzedAt":"2026-08-06T20:08:02.189Z","schemaVersion":2},"datasetVersion":"2026-08-06T23:17:07.152Z"}