The middleware pipeline calls UseAuthorization() BEFORE UseAuthentication().

Why this matters

ASP.NET Core requires authentication to run first so that HttpContext.User is populated before authorization evaluates policies; in the reverse order authorization sees an unauthenticated, anonymous user, which either blocks legitimate users or, with a permissive fallback policy, lets requests through unauthenticated (CWE-696). This is a common AI-generated ordering mistake when wiring up Program.cs.

Register the middleware in the correct order: call app.UseAuthentication(); immediately before app.UseAuthorization(); (both after UseRouting() and before the endpoint mapping).

using Microsoft.AspNetCore.Builder;

public class Program
{
    public static void Configure(WebApplication app)
    {
        app.UseRouting();
        // ruleid: auth.csharp.web.authentication-after-authorization
        app.UseAuthorization();
        app.UseAuthentication();
        app.MapControllers();
    }
}

using Microsoft.AspNetCore.Builder;

public class Program
{
    // Correct order: authentication runs before authorization.
    public static void Configure(WebApplication app)
    {
        app.UseRouting();
        app.UseAuthentication();
        app.UseAuthorization();
        app.MapControllers();
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.csharp.web.authentication-after-authorization -- <reason>

References