When the user is not authorized and he tries to make a request the status code should be 401, but it’s 404.

here is my how I added cookie auth. In controllers I basically use attribute [Authorize] and authentification works, everything is fine, but when unauthorized user tries to make a request status code is 404, not 401

program.cs:

var builder = WebApplication.CreateBuilder(args);

builder.Host.UseSerilog((hostContext, services, configuration) =>
{
    configuration.MinimumLevel.Override("Microsoft", LogEventLevel.Information)
        .WriteTo.Console()
        .WriteTo.File("Logs/log-.txt",
        rollingInterval: RollingInterval.Day);
});

builder.Services.AddMapper();

builder.Services.AddApplication();
builder.Services.AddPersistence(builder.Configuration.GetConnectionString("MySql"));
builder.Services.AddControllers();

builder.Services.AddConfiguredCors();
builder.Services.AddConfiguredIdentityCore();
builder.Services.AddConfiguredSwagger();

builder.Services.AddSingleton<ICurrentUserService, CurrentUserService>();

builder.Services.AddHttpContextAccessor();

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme);

var app = builder.Build();

#endregion

#region Configure

if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();

    using var scope = app.Services.CreateScope();
    var db = scope.ServiceProvider.GetRequiredService<PfsDbContext>();
    DbInitializer.Initialize(db);
}

app.UseCustomExceptionHandler();
app.UseRouting();

app.UseCors("AllowAll");

app.UseAuthentication();
app.UseAuthorization();

app.MapControllers();

app.Run();

#endregion

I was just googling and didn’t find the answer