How do you short-circuit the pipeline?

Simply don’t call await next() in a middleware:

if (!context.User.Identity.IsAuthenticated)

context.Response.StatusCode = 401;

return; // Short-circuits

await next(); // only called if authenticated