dotnet/aspnetcore · error · NotSupportedException

The authorization data specifies an authentication scheme wi

Error message

The authorization data specifies an authentication scheme with value '{0}'. Authentication schemes cannot be specified for components.

What it means

Thrown as a NotSupportedException by AuthorizeViewCore.EnsureNoAuthenticationSchemeSpecified when any IAuthorizeData entry in the authorization metadata has a non-empty AuthenticationSchemes value. Blazor component authorization is stateful — by the time it runs, the framework already holds a specific ClaimsPrincipal from the AuthenticationStateProvider, so selecting an authentication scheme is meaningless and explicitly disallowed.

Source

Thrown at src/Components/Authorization/src/AuthorizeViewCore.cs:135

        {
            // The metadata contained nothing that contributes to a policy.
            return true;
        }

        var result = await AuthorizationService.AuthorizeAsync(user, Resource, policy);
        return result.Succeeded;
    }

    private static void EnsureNoAuthenticationSchemeSpecified(object[] metadata)
    {
        // It's not meaningful to specify a nonempty scheme, since by the time Components
        // authorization runs, we already have a specific ClaimsPrincipal (we're stateful).
        // To avoid any confusion, ensure the developer isn't trying to specify a scheme.
        for (var i = 0; i < metadata.Length; i++)
        {
            if (metadata[i] is IAuthorizeData entry && !string.IsNullOrEmpty(entry.AuthenticationSchemes))
            {
                throw new NotSupportedException($"The authorization data specifies an authentication scheme with value '{entry.AuthenticationSchemes}'. Authentication schemes cannot be specified for components.");
            }
        }
    }
}

View on GitHub (pinned to 294cab2f9b)

Solutions

Remove the AuthenticationSchemes property from any [Authorize] attribute applied to Blazor components or pages.
If you need scheme-specific auth, handle it at the authentication/SignIn level (configure the AuthenticationStateProvider) rather than in component authorization metadata.
Use role-based or policy-based authorization instead: [Authorize(Roles = "...")] or [Authorize(Policy = "...")].

Example fix

// before
@attribute [Authorize(AuthenticationSchemes = "Bearer")]

// after
@attribute [Authorize(Policy = "MyPolicy"]

Defensive patterns

Strategy: validation

Validate before calling

// Validate authorize data before passing to components
foreach (var entry in authorizeData.OfType<IAuthorizeData>())
{
    if (!string.IsNullOrEmpty(entry.AuthenticationSchemes))
        throw new NotSupportedException("Do not set AuthenticationSchemes on component-level [Authorize].");
}

Prevention

Never use AuthenticationSchemes in [Authorize] on Blazor components/pages.
Reserve scheme selection for middleware/endpoint configuration, not component metadata.

When it happens

Trigger: Specifying an AuthenticationSchemes property on [Authorize] attribute used in a Blazor component or page (e.g., [Authorize(AuthenticationSchemes = "Bearer"]) applied to a Razor component). The loop at AuthorizeViewCore.cs:131-137 inspects all metadata entries.

Common situations: Porting MVC/controller-based [Authorize(AuthenticationSchemes = ...)] attributes to Blazor pages; using shared authorization policy objects that include scheme configuration in a Blazor context.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of dotnet/aspnetcore@294cab2f9b (2026-08-06). Data as JSON: /api/errors/726246468c8e928a. Report an issue: GitHub.