CurrentUser is null even though [Authorize] is applied — controller method still executes after failed authentication
Hey ABP team,
We’re running into an issue where a controller method is still being executed even though authentication has failed. This causes CurrentUser.GetId() to throw an exception because CurrentUser is null.
Here's the setup:
[RemoteService]
[Area("umob")]
[ControllerName("UserDocument")]
[Authorize]
public class UserDocumentController : AppVersionRestrictedController
{
private readonly IUserDocumentHelperAppService _userDocumentHelperAppService;
public UserDocumentController(IUserDocumentHelperAppService userDocumentHelperAppService)
{
_userDocumentHelperAppService = userDocumentHelperAppService;
}
[HttpPost]
[Route("/api/umob/userdocument/validate")]
public async Task<UserDocumentValidationDto> Validate(PostUserDocumentValidation data) =>
await _userDocumentHelperAppService.ValidateUserDocumentForAsset(CurrentUser.GetId(), data);
}
In our logs, we clearly see that OpenIddict.Validation.AspNetCore logs an authentication failure:
The token is no longer valid because the user’s session expired. Validation.AspNetCore was not authenticated.
Yet, immediately afterward, the controller method still runs. We end up with this exception:
System.InvalidOperationException: Nullable object must have a value.
at uMob.Controllers.UserDocumentController.Validate(...)
I've verified that:
[Authorize] is on the controller level.[AllowAnonymous] is applied.Do you know how this can happen in an ABP-based app?
Is there any ABP config or middleware behavior that could cause CurrentUser to be null while still executing controller methods?
Our CI/CD pipelines started failing this afternoon. Did something change with regards to the packages available on the closed NuGet instance?
