[marcominerva]

Since #67110, DefaultPolicy.ServeResponseAsync clears AllowCacheStorage for any authenticated user. That check is only needed when the user becomes authenticated after the output cache middleware ran. It also overrode custom policies that allow storage in CacheRequestAsync for users who were already authenticated, so those responses silently stopped being cached.

DefaultPolicy now records in CacheRequestAsync whether the user was already authenticated. ServeResponseAsync only clears storage for users who became authenticated after that point. Custom policies work again for users authenticated before the output cache middleware ran, and responses for users authenticated later are still never stored.

Fixes #69386

[dotnet-policy-service]

Thanks for your PR, @marcominerva. Someone from the team will get assigned to your PR shortly and we'll get it reviewed.

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused implementation preserves late-authentication protection and includes coverage for both affected middleware orderings.

Review effort: Balanced
Findings: None

What changed in this PR

Fixes output caching so custom policies can cache responses for users authenticated before the caching middleware runs, while rejecting storage when authentication occurs afterward.

Changes:

• Records the request’s initial authentication state.
• Applies the response-stage authentication check only to newly authenticated users.
• Adds unit and integration regression coverage.

File	Description
src/​Middleware/​OutputCaching/​src/​Policies/​DefaultPolicy.cs	Refines the authenticated-response storage check.
src/​Middleware/​OutputCaching/​src/​OutputCacheContext.cs	Stores initial authentication state.
src/​Middleware/​OutputCaching/​test/​OutputCachePolicyProviderTests.cs	Tests policy behavior for early and late authentication.
src/​Middleware/​OutputCaching/​test/​OutputCacheTests.cs	Verifies end-to-end cache storage behavior.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[dotnet-policy-service]

Looks like this PR hasn't been active for some time and the codebase could have been changed in the meantime.
To make sure no conflicting changes have occurred, please rerun validation before merging. You can do this by leaving an /azp run comment here (requires commit rights), or by simply closing and reopening.

[DeagleGross]

/backport to release/10.0

[DeagleGross]

/backport to release/11.0

[github-actions]

Started backporting to release/10.0 (link to workflow run)

[github-actions]

Started backporting to release/11.0 (link to workflow run)