Thanks for your PR, @Kahbazi. Someone from the team will get assigned to your PR shortly and we'll get it reviewed.

@Kahbazi I tracked down the reason for the original log and I think we can prevent it without this new anonymous check.

The following should be changed from Fail to NoResult.

Can you try that?

Background:
OIDC is being set as the default scheme, rather than cookies. The auth middleware then runs Authenticate on OIDC every request. That delegates to Cookies, which returns no identity. OIDC's base class then returns a failure instead of NoResult.

So isn't this a subtle breaking change/behavior change? Users are able to check the authenticate result directly, and now we would be returning NoResult instead of Fail... Arguably there's no difference, but it still seems a bit risky

It is a minor behavior change, but I think it's a beneficial one. Auth didn't fail, there's just no user available. Also, I would not expect users to be directly saying Authenticate(OIDC), it would be Authenticate(Cookies) to get the current user and that doesn't go down this code path.

I agree with @Tratcher on the fix, this code shouldn't be checking for allow anonymous.

I marked it as a breaking change. @Tratcher can you write up the breaking change after this PR gets merged?

Done: aspnet/Announcements#491