Authorization not working with Post, Put or Patch in Azure App Service - azure-web-app-service

Question

I have an ASP.NET Core 6 MVC / Web API app I am deploying to Azure which uses the ASP.NET Authentication Framework. It uses cookie authentication with VueJs on the front end.
When I deploy to Azure Web Services, the [Authorize] attribute returns a 401 for all Patch, Put or Post calls. However, for all Get calls, the [Authorize] attribute works fine, and the API call is authenticated.
I've tried removing the [Authorize] attribute and inspected the claims and identity. Again, for all non Get calls, the identity is empty and User.Identity.IsAuthenticated is false.
But if I just change it back to a Get call, then all identity information comes through.
I can't think of any reason why the .NET authentication stack would great a Get call differently than a Post call when deployed on Azure.
Locally on my dev machine, and on a regular IIS deployment everything works fine. I've inspected the http packets, and the identity cookie is being sent by the client.
Any pointers on where to look is appreciated.

Answer 1

I have come across the scenario when using postman to create the users Which uses POST request.
GET https://graph.microsoft.com/v1.0/users
Even for GET , i was getting unauthorized as previously read permissions are not given and invalid bearer tpoken was given
You must be missing receiving auth access token , please add the authorization header in the code which is done In the Configure method in Startup.cs class
app.UseSession();
app.Use(async (context, next) =>
{
var JWToken = context.Session.GetString("Token");
if (!string.IsNullOrEmpty(Token))
{
context.Request.Headers.Add("Authorization", "Bearer " + Token);
}
await next();
});
app.UseAuthentication();
app.UseAuthorization();
check the scope is provided in controller part where [Authorize] attribute is given.
Check Protect a web API with the Microsoft identity platform - Microsoft Entra | Microsoft Learn
I could get the GET request response successfully after giving below permissions
I have these Directory.Read.All and User.Read delegated and application permissions only.
POST request needs write permissions , in my case to create users , it requires User.ReadWrite.All and Directory.ReadWrite.All Application permissions
Create User - Microsoft Graph v1.0 | Microsoft Learn
After giving required permissions and getting admin grant consent .
I could execute the post request successfully and create the users
Please check POST request requirements and permissions needed and make sure they are granted admin consent.It can be permissions with scopes that are granted to particular web api.
Make sure the access token or user interaction is done and permissions required are granted.