I was using authorization fine previously with .NET 5, but suddenly after .NET 5.0.102 Context.User.Identity was not populated at all in some methods. Nothing else changed, but some places where identity was supposed to be used just didn't get the information.
This happened in controller methods as well as in Signalr hub methods. Why?
It seems .NET 5.0.102 changes the way authorization is handled and I couldn't find this from the documentation. My Signalr hub didn't have the Authorize attribute set so OnConnected etc methods didn't get any identity information. The same with the controller methods.
So every single place where you need identity needs to have Authorize attribute set!
This doesn't work in hub methods, the whole hub has to have the attribute.
I assume this is to reduce the places where the identity information is available unless you specifically ask for it, but is a breaking change that I for one did not see coming.
Note that this is documented behavior: the attribute should always be there, but for some reason it worked without before also and may cause cases where it’s left out.