> ## Documentation Index > Fetch the complete documentation index at: https://ai.easyaf.dev/llms.txt > Use this file to discover all available pages before exploring further. # ProtectedResourceMetadataMiddleware > Publishes RFC 9728 protected resource metadata for the configured route bases, and rewrites the `WWW-Authenticate` challenge on a `401` beneath one of those ... ## Definition **Assembly:** Microsoft.OData.Mcp.AspNetCore.dll **Namespace:** Microsoft.OData.Mcp.AspNetCore.Authentication **Inheritance:** System.Object ## Syntax ```csharp theme={null} Microsoft.OData.Mcp.AspNetCore.Authentication.ProtectedResourceMetadataMiddleware ``` ## Summary Publishes RFC 9728 protected resource metadata for the configured route bases, and rewrites the `WWW-Authenticate` challenge on a `401` beneath one of those bases so a client is told where that document lives. ## Remarks [ProtectedResourceMetadataStartupFilter](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/AspNetCore/Authentication/ProtectedResourceMetadataStartupFilter.md) puts this at the very front of the pipeline, before authentication and authorization, because a protected resource metadata document that answers `401` is useless — a client that follows `resource_metadata` into a challenge has learned nothing. That is the "Graph trap" in `specs/v3/AUTHENTICATION.md`, and the only defence against it is serving the document anonymously. The default route base is the application root. Explicit [ProtectedResourceMetadataOptions.Prefixes](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/AspNetCore/Authentication/ProtectedResourceMetadataOptions.md#prefixes) entries are Endpoint Routing route bases, including an empty string. ## Examples ```csharp theme={null} GET /.well-known/oauth-protected-resource 200 application/json {"resource":"https://api.contoso.com","authorization_servers":["https://login.contoso.com/v2.0"],"bearer_methods_supported":["header"]} ``` ## Constructors ### .ctor Initializes a new instance of the [ProtectedResourceMetadataMiddleware](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/AspNetCore/Authentication/ProtectedResourceMetadataMiddleware.md) class. #### Syntax ```csharp theme={null} public ProtectedResourceMetadataMiddleware(Microsoft.AspNetCore.Http.RequestDelegate next, Microsoft.Extensions.Options.IOptions options, Microsoft.Extensions.Logging.ILogger logger) ``` #### Parameters | Name | Type | Description | | - | - | - | | `next` | `Microsoft.AspNetCore.Http.RequestDelegate` | The next middleware in the pipeline. | | `options` | `Microsoft.Extensions.Options.IOptions` | What this resource publishes about itself. | | `logger` | `Microsoft.Extensions.Logging.ILogger` | The logger the resolved prefixes and any unparseable challenge are recorded to. | #### Exceptions | Exception | Description | | - | - | | `ArgumentNullException` | Thrown when *next*, *options*, or *logger* is | | [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null). | | ### .ctor Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public Object() ``` ## Methods ### Equals Inherited Virtual > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public virtual bool Equals(object obj) ``` #### Parameters | Name | Type | Description | | - | - | - | | `obj` | `object?` | - | #### Returns Type: `bool` ### Equals Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public static bool Equals(object objA, object objB) ``` #### Parameters | Name | Type | Description | | - | - | - | | `objA` | `object?` | - | | `objB` | `object?` | - | #### Returns Type: `bool` ### GetHashCode Inherited Virtual > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public virtual int GetHashCode() ``` #### Returns Type: `int` ### GetType Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public System.Type GetType() ``` #### Returns Type: `System.Type` ### InvokeAsync Serves a protected resource metadata document, or arms the challenge annotation for a request that falls beneath a covered route base, then continues the pipeline. #### Syntax ```csharp theme={null} public System.Threading.Tasks.Task InvokeAsync(Microsoft.AspNetCore.Http.HttpContext context) ``` #### Parameters | Name | Type | Description | | - | - | - | | `context` | `Microsoft.AspNetCore.Http.HttpContext` | The request being served. | #### Returns Type: `System.Threading.Tasks.Task` A task that completes when the request has been handled. #### Exceptions | Exception | Description | | - | - | | `ArgumentNullException` | Thrown when *context* is [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null). | #### Remarks A well-known path that names a prefix this app does not serve is passed through untouched rather than answered with a `404`: the path may belong to another component in the same host. ### MemberwiseClone Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} protected internal object MemberwiseClone() ``` #### Returns Type: `object` ### ReferenceEquals Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public static bool ReferenceEquals(object objA, object objB) ``` #### Parameters | Name | Type | Description | | - | - | - | | `objA` | `object?` | - | | `objB` | `object?` | - | #### Returns Type: `bool` ### ToString Inherited Virtual > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public virtual string ToString() ``` #### Returns Type: `string?` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.