diff --git a/src/Microsoft.AspNetCore.Authentication.Cookies/CookieAuthenticationDefaults.cs b/src/Microsoft.AspNetCore.Authentication.Cookies/CookieAuthenticationDefaults.cs
index 2baa9e45cd..ad0e17a096 100644
--- a/src/Microsoft.AspNetCore.Authentication.Cookies/CookieAuthenticationDefaults.cs
+++ b/src/Microsoft.AspNetCore.Authentication.Cookies/CookieAuthenticationDefaults.cs
@@ -1,7 +1,6 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
-using System.Diagnostics.CodeAnalysis;
 using Microsoft.AspNetCore.Http;
 
 namespace Microsoft.AspNetCore.Authentication.Cookies
@@ -25,21 +24,18 @@ namespace Microsoft.AspNetCore.Authentication.Cookies
         /// The default value used by CookieAuthenticationMiddleware for the
         /// CookieAuthenticationOptions.LoginPath
         /// </summary>
-        [SuppressMessage("Microsoft.Naming", "CA1726:UsePreferredTerms", MessageId = "Login", Justification = "By design")]
         public static readonly PathString LoginPath = new PathString("/Account/Login");
 
         /// <summary>
         /// The default value used by CookieAuthenticationMiddleware for the
         /// CookieAuthenticationOptions.LogoutPath
         /// </summary>
-        [SuppressMessage("Microsoft.Naming", "CA1726:UsePreferredTerms", MessageId = "Logout", Justification = "By design")]
         public static readonly PathString LogoutPath = new PathString("/Account/Logout");
 
         /// <summary>
         /// The default value used by CookieAuthenticationMiddleware for the
         /// CookieAuthenticationOptions.AccessDeniedPath
         /// </summary>
-        [SuppressMessage("Microsoft.Naming", "CA1726:UsePreferredTerms", MessageId = "Login", Justification = "By design")]
         public static readonly PathString AccessDeniedPath = new PathString("/Account/AccessDenied");
 
         /// <summary>
diff --git a/src/Microsoft.AspNetCore.Authentication.Cookies/CookieAuthenticationOptions.cs b/src/Microsoft.AspNetCore.Authentication.Cookies/CookieAuthenticationOptions.cs
index 51cf43a0f1..8a451c9c71 100644
--- a/src/Microsoft.AspNetCore.Authentication.Cookies/CookieAuthenticationOptions.cs
+++ b/src/Microsoft.AspNetCore.Authentication.Cookies/CookieAuthenticationOptions.cs
@@ -3,7 +3,6 @@
 
 using System;
 using System.ComponentModel;
-using System.Diagnostics.CodeAnalysis;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.DataProtection;
@@ -103,13 +102,11 @@ namespace Microsoft.AspNetCore.Builder
         /// LoginPath grants a new SignIn identity, the ReturnUrlParameter value is used to redirect the browser back  
         /// to the url which caused the original unauthorized status code.
         /// </summary>
-        [SuppressMessage("Microsoft.Naming", "CA1726:UsePreferredTerms", MessageId = "Login", Justification = "By design")]
         public PathString LoginPath { get; set; }
 
         /// <summary>
         /// If the LogoutPath is provided the middleware then a request to that path will redirect based on the ReturnUrlParameter.
         /// </summary>
-        [SuppressMessage("Microsoft.Naming", "CA1726:UsePreferredTerms", MessageId = "Logout", Justification = "By design")]
         public PathString LogoutPath { get; set; }
 
         /// <summary>
@@ -124,7 +121,6 @@ namespace Microsoft.AspNetCore.Builder
         /// string parameter looked for when a request arrives on the login path or logout path, in order to return to the 
         /// original url after the action is performed.
         /// </summary>
-        [SuppressMessage("Microsoft.Design", "CA1056:UriPropertiesShouldNotBeStrings", Justification = "ReturnUrl is the name of a querystring parameter")]
         public string ReturnUrlParameter { get; set; }
 
         /// <summary>
diff --git a/src/Microsoft.AspNetCore.Authentication.Cookies/Events/CookieRedirectContext.cs b/src/Microsoft.AspNetCore.Authentication.Cookies/Events/CookieRedirectContext.cs
index c26cd5d662..2cbb5ff095 100644
--- a/src/Microsoft.AspNetCore.Authentication.Cookies/Events/CookieRedirectContext.cs
+++ b/src/Microsoft.AspNetCore.Authentication.Cookies/Events/CookieRedirectContext.cs
@@ -1,7 +1,6 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
-using System.Diagnostics.CodeAnalysis;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Http.Authentication;
@@ -20,7 +19,6 @@ namespace Microsoft.AspNetCore.Authentication.Cookies
         /// <param name="options">The cookie middleware options</param>
         /// <param name="redirectUri">The initial redirect URI</param>
         /// <param name="properties">The <see cref="AuthenticationProperties"/>.</param>
-        [SuppressMessage("Microsoft.Design", "CA1054:UriParametersShouldNotBeStrings", MessageId = "2#", Justification = "Represents header value")]
         public CookieRedirectContext(HttpContext context, CookieAuthenticationOptions options, string redirectUri, AuthenticationProperties properties)
             : base(context, options)
         {
@@ -31,7 +29,6 @@ namespace Microsoft.AspNetCore.Authentication.Cookies
         /// <summary>
         /// Gets or Sets the URI used for the redirect operation.
         /// </summary>
-        [SuppressMessage("Microsoft.Design", "CA1056:UriPropertiesShouldNotBeStrings", Justification = "Represents header value")]
         public string RedirectUri { get; set; }
 
         public AuthenticationProperties Properties { get; }
diff --git a/src/Microsoft.AspNetCore.Authentication.Google/GoogleMiddleware.cs b/src/Microsoft.AspNetCore.Authentication.Google/GoogleMiddleware.cs
index ba6fb7d2ef..eb98e447b3 100644
--- a/src/Microsoft.AspNetCore.Authentication.Google/GoogleMiddleware.cs
+++ b/src/Microsoft.AspNetCore.Authentication.Google/GoogleMiddleware.cs
@@ -2,7 +2,6 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
-using System.Diagnostics.CodeAnalysis;
 using System.Text.Encodings.Web;
 using Microsoft.AspNetCore.Authentication.OAuth;
 using Microsoft.AspNetCore.Builder;
@@ -16,7 +15,6 @@ namespace Microsoft.AspNetCore.Authentication.Google
     /// <summary>
     /// An ASP.NET Core middleware for authenticating users using Google OAuth 2.0.
     /// </summary>
-    [SuppressMessage("Microsoft.Design", "CA1001:TypesThatOwnDisposableFieldsShouldBeDisposable", Justification = "Middleware are not disposable.")]
     public class GoogleMiddleware : OAuthMiddleware<GoogleOptions>
     {
         /// <summary>
diff --git a/src/Microsoft.AspNetCore.Authentication.OAuth/OAuthMiddleware.cs b/src/Microsoft.AspNetCore.Authentication.OAuth/OAuthMiddleware.cs
index 7ef1863226..75139c1c80 100644
--- a/src/Microsoft.AspNetCore.Authentication.OAuth/OAuthMiddleware.cs
+++ b/src/Microsoft.AspNetCore.Authentication.OAuth/OAuthMiddleware.cs
@@ -2,7 +2,6 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
-using System.Diagnostics.CodeAnalysis;
 using System.Globalization;
 using System.Net.Http;
 using System.Text.Encodings.Web;
@@ -17,7 +16,6 @@ namespace Microsoft.AspNetCore.Authentication.OAuth
     /// <summary>
     /// An ASP.NET Core middleware for authenticating users using OAuth services.
     /// </summary>
-    [SuppressMessage("Microsoft.Design", "CA1001:TypesThatOwnDisposableFieldsShouldBeDisposable", Justification = "Middleware are not disposable.")]
     public class OAuthMiddleware<TOptions> : AuthenticationMiddleware<TOptions> where TOptions : OAuthOptions, new()
     {
         /// <summary>
diff --git a/src/Microsoft.AspNetCore.Authentication.OpenIdConnect/OpenIdConnectMiddleware.cs b/src/Microsoft.AspNetCore.Authentication.OpenIdConnect/OpenIdConnectMiddleware.cs
index 76936e25a6..80f2ca2ba3 100644
--- a/src/Microsoft.AspNetCore.Authentication.OpenIdConnect/OpenIdConnectMiddleware.cs
+++ b/src/Microsoft.AspNetCore.Authentication.OpenIdConnect/OpenIdConnectMiddleware.cs
@@ -2,7 +2,6 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
-using System.Diagnostics.CodeAnalysis;
 using System.Net.Http;
 using System.Text;
 using System.Text.Encodings.Web;
@@ -32,7 +31,6 @@ namespace Microsoft.AspNetCore.Authentication.OpenIdConnect
         /// <param name="sharedOptions"></param>
         /// <param name="options"></param>
         /// <param name="htmlEncoder">The <see cref="HtmlEncoder"/>.</param>
-        [SuppressMessage("Microsoft.Reliability", "CA2000:Dispose objects before losing scope", Justification = "Managed by caller")]
         public OpenIdConnectMiddleware(
             RequestDelegate next,
             IDataProtectionProvider dataProtectionProvider,
diff --git a/src/Microsoft.AspNetCore.Authentication.OpenIdConnect/OpenIdConnectOptions.cs b/src/Microsoft.AspNetCore.Authentication.OpenIdConnect/OpenIdConnectOptions.cs
index 1b179c3369..acf9d77e40 100644
--- a/src/Microsoft.AspNetCore.Authentication.OpenIdConnect/OpenIdConnectOptions.cs
+++ b/src/Microsoft.AspNetCore.Authentication.OpenIdConnect/OpenIdConnectOptions.cs
@@ -4,7 +4,6 @@
 using System;
 using System.Collections.Generic;
 using System.ComponentModel;
-using System.Diagnostics.CodeAnalysis;
 using System.IdentityModel.Tokens.Jwt;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.OpenIdConnect;
@@ -45,7 +44,6 @@ namespace Microsoft.AspNetCore.Builder
         /// <para>UseTokenLifetime: false.</para>
         /// </remarks>
         /// <param name="authenticationScheme"> will be used to when creating the <see cref="System.Security.Claims.ClaimsIdentity"/> for the AuthenticationScheme property.</param>
-        [SuppressMessage("Microsoft.Globalization", "CA1303:Do not pass literals as localized parameters", MessageId = "Microsoft.Owin.Security.OpenIdConnect.OpenIdConnectOptions.set_Caption(System.String)", Justification = "Not a LOC field")]
         public OpenIdConnectOptions(string authenticationScheme)
         {
             AuthenticationScheme = authenticationScheme;
@@ -124,8 +122,6 @@ namespace Microsoft.AspNetCore.Builder
         /// Gets or sets the 'post_logout_redirect_uri'
         /// </summary>
         /// <remarks>This is sent to the OP as the redirect for the user-agent.</remarks>
-        [SuppressMessage("Microsoft.Design", "CA1056:UriPropertiesShouldNotBeStrings", Justification = "By design")]
-        [SuppressMessage("Microsoft.Naming", "CA1726:UsePreferredTerms", MessageId = "Logout", Justification = "This is the term used in the spec.")]
         public string PostLogoutRedirectUri { get; set; }
 
         /// <summary>
diff --git a/src/Microsoft.AspNetCore.Authentication.Twitter/Messages/RequestTokenSerializer.cs b/src/Microsoft.AspNetCore.Authentication.Twitter/Messages/RequestTokenSerializer.cs
index a96a379c18..88b10d3d60 100644
--- a/src/Microsoft.AspNetCore.Authentication.Twitter/Messages/RequestTokenSerializer.cs
+++ b/src/Microsoft.AspNetCore.Authentication.Twitter/Messages/RequestTokenSerializer.cs
@@ -2,7 +2,6 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
-using System.Diagnostics.CodeAnalysis;
 using System.IO;
 using Microsoft.AspNetCore.Http.Authentication;
 
@@ -20,7 +19,6 @@ namespace Microsoft.AspNetCore.Authentication.Twitter
         /// </summary>
         /// <param name="model">The token to serialize</param>
         /// <returns>A byte array containing the serialized token</returns>
-        [SuppressMessage("Microsoft.Usage", "CA2202:Do not dispose objects multiple times", Justification = "Dispose is idempotent")]
         public virtual byte[] Serialize(RequestToken model)
         {
             using (var memory = new MemoryStream())
@@ -39,7 +37,6 @@ namespace Microsoft.AspNetCore.Authentication.Twitter
         /// </summary>
         /// <param name="data">A byte array containing the serialized token</param>
         /// <returns>The Twitter request token</returns>
-        [SuppressMessage("Microsoft.Usage", "CA2202:Do not dispose objects multiple times", Justification = "Dispose is idempotent")]
         public virtual RequestToken Deserialize(byte[] data)
         {
             using (var memory = new MemoryStream(data))
diff --git a/src/Microsoft.AspNetCore.Authentication.Twitter/TwitterMiddleware.cs b/src/Microsoft.AspNetCore.Authentication.Twitter/TwitterMiddleware.cs
index 542115117f..67fb903dd1 100644
--- a/src/Microsoft.AspNetCore.Authentication.Twitter/TwitterMiddleware.cs
+++ b/src/Microsoft.AspNetCore.Authentication.Twitter/TwitterMiddleware.cs
@@ -2,7 +2,6 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
-using System.Diagnostics.CodeAnalysis;
 using System.Globalization;
 using System.Net.Http;
 using System.Text.Encodings.Web;
@@ -17,7 +16,6 @@ namespace Microsoft.AspNetCore.Authentication.Twitter
     /// <summary>
     /// ASP.NET Core middleware for authenticating users using Twitter.
     /// </summary>
-    [SuppressMessage("Microsoft.Design", "CA1001:TypesThatOwnDisposableFieldsShouldBeDisposable", Justification = "Middleware are not disposable.")]
     public class TwitterMiddleware : AuthenticationMiddleware<TwitterOptions>
     {
         private readonly HttpClient _httpClient;
diff --git a/src/Microsoft.AspNetCore.Authentication/DataHandler/PropertiesSerializer.cs b/src/Microsoft.AspNetCore.Authentication/DataHandler/PropertiesSerializer.cs
index 542553cf2b..dd30b45ae0 100644
--- a/src/Microsoft.AspNetCore.Authentication/DataHandler/PropertiesSerializer.cs
+++ b/src/Microsoft.AspNetCore.Authentication/DataHandler/PropertiesSerializer.cs
@@ -3,7 +3,6 @@
 
 using System;
 using System.Collections.Generic;
-using System.Diagnostics.CodeAnalysis;
 using System.IO;
 using Microsoft.AspNetCore.Http.Authentication;
 
@@ -15,7 +14,6 @@ namespace Microsoft.AspNetCore.Authentication
 
         public static PropertiesSerializer Default { get; } = new PropertiesSerializer();
 
-        [SuppressMessage("Microsoft.Usage", "CA2202:Do not dispose objects multiple times", Justification = "Dispose is idempotent")]
         public virtual byte[] Serialize(AuthenticationProperties model)
         {
             using (var memory = new MemoryStream())
@@ -29,7 +27,6 @@ namespace Microsoft.AspNetCore.Authentication
             }
         }
 
-        [SuppressMessage("Microsoft.Usage", "CA2202:Do not dispose objects multiple times", Justification = "Dispose is idempotent")]
         public virtual AuthenticationProperties Deserialize(byte[] data)
         {
             using (var memory = new MemoryStream(data))