For those who is searching the answer - I had the same issue and my solution was:
Enable anonymous globally in web.config
<system.webServer>
<security>
<authentication>
<windowsAuthentication enabled="true" />
<anonymousAuthentication enabled="true"/>
</authentication>
</security>
</system.webServer>
Add a default controller with empty Route and AllowAnonymous attribute
[Route("")]
[ApiController]
[AllowAnonymous]
public class DefaultController : ControllerBase
{
private readonly ILogger _logger;
public DefaultController(ILogger logger)
{
_logger = logger;
}
[HttpGet]
public ContentResult Get()
{
_logger.LogTrace("Warmup called");
return Content("This is my webapi. see <a href='swagger/index.html'>here</a>",
"text/html; charset=utf-8");
}
}
For those controllers that needs authentication add an Authorise attribute:
[Route("[controller]")]
[ApiController]
[EnableCors]
[Authorize]
public class MyAuthenticatedController : ControllerBase
{
//...
}
Also you can add a separate controller for warming up an application and specify its route in applicationInitialization
web.config's section (works for IIS >= 8.0) :
<system.webServer>
<!-- ... -->
<applicationInitialization doAppInitAfterRestart="true" skipManagedModules="false">
<add initializationPage="/warmup" />
</applicationInitialization>
</system.webServer>
And finally, an answer that was helpful for me.