Fix bug on missing Authorization header

[magicleon94]

I noticed that when the Authorization header is missing (line 21) no error is returned, hence the filter passes and the decorated API (with [JwtAuthentication]) is executed normally.
Adding context.ErrorResult assignment should fix the problem.
Since I'm not an expert in this field I apologise if my proposition is wrong, and I'd like to learn about what I've done wrong.

[contactsamie]

this is important even for demo

[UnreachableCode]

This is a big deal. I'm surprised nobody has picked this up in the highly rated Stackoverflow question which points to it: https://stackoverflow.com/questions/40281050/jwt-authentication-for-asp-net-web-api

[tno2007]

I have tried to add this line that you recommended...

if (authorization == null || authorization.Scheme != "Bearer")
{
    context.ErrorResult = new JwtAuthenticationFailureResult("Missing Authorization Header", request);
    return;
}

but it makes [AllowAnonymous] not work anymore.

In my authentication controller where I require [AllowAnonymous] (because I am just logging in), I get:
401 Missing Authorization Header

The initial code is working as it should.

if (authorization == null || authorization.Scheme != "Bearer")
    return;