C# ApiController : multiple authentication methods

Below, you can find the text related to the question/problem. In the video, the question will be presented first, followed by the answers. If the video moves too fast, feel free to pause and review the answers. If you need more detailed information, you can find the necessary sources and links at the bottom of this description. I hope this video has been helpful, and even if it doesn't directly solve your problem, it will guide you to the source of the solution. I'd appreciate it if you like the video and subscribe to my channel!C# ApiController : multiple authentication methods

We have an ASP.NET Core 7 Web API controller and we use Azure AD B2C as the main authentication which works fine. We need a single end point to be basic auth. I've tried creating a custom authorization handler which does this and that works fine. I can see it working through and doing context.Succeed but I still get a 401 response from my call. It's as if it's then doing the Azure AD B2C check which fails.
context.Succeed
I've tried putting [AllowAnonymous] attribute on the endpoint as well as [Authorize(Policy = "BasicAuth")] but then no auth is applied.
[AllowAnonymous]
[Authorize(Policy = "BasicAuth")]
public class BasicAuthHandler : AuthorizationHandler BasicAuthRequirement
{
private readonly IHttpContextAccessor _httpContextAccessor;
private readonly AppSettings _settings;

public BasicAuthHandler(IHttpContextAccessor httpContextAccessor, IOptions AppSettings settings)
{
_httpContextAccessor = httpContextAccessor;
_settings = settings.Value;
}

protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, BasicAuthRequirement requirement)
{
if (ValidateBasicAuth(_httpContextAccessor.HttpContext))
{
context.Succeed(requirement);
}
else
{
var response = _httpContextAccessor.HttpContext.Response;
response.Clear();
response.StatusCode = 401;
context.Fail();
}

return Task.CompletedTask;
}

private bool ValidateBasicAuth(HttpContext context)
{
string authHeader = context.Request.Headers["Authorization"];

if (authHeader != null && authHeader.StartsWith("Basic"))
{
string encodedUsernamePassword = authHeader.Substring("Basic ".Length).Trim();
Encoding encoding = Encoding.GetEncoding("iso-8859-1");
string usernamePassword = encoding.GetString(Convert.FromBase64String(encodedUsernamePassword));

int seperatorIndex = usernamePassword.IndexOf(':');

var username = usernamePassword.Substring(0, seperatorIndex);
var password = usernamePassword.Substring(seperatorIndex + 1);
if (username.Equals(_settings.BasicAuth.Username, StringComparison.OrdinalIgnoreCase) && password.Equals(_settings.BasicAuth.Password))
return true;
}

return false;
}
}

public class BasicAuthHandler : AuthorizationHandler BasicAuthRequirement
{
private readonly IHttpContextAccessor _httpContextAccessor;
private readonly AppSettings _settings;

public BasicAuthHandler(IHttpContextAccessor httpContextAccessor, IOptions AppSettings settings)
{
_httpContextAccessor = httpContextAccessor;
_settings = settings.Value;
}

protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, BasicAuthRequirement requirement)
{
if (ValidateBasicAuth(_httpContextAccessor.HttpContext))
{
context.Succeed(requirement);
}
else
{
var response = _httpContextAccessor.HttpContext.Response;
response.Clear();
response.StatusCode = 401;
context.Fail();
}

return Task.CompletedTask;
}

private bool ValidateBasicAuth(HttpContext context)
{
string authHeaderSource of the question:

Question and source license information: