ASP.NET Core 3.1 doesn't authorize bearer token

Question

I added the [Authorize(Roles="CompanyRole")] annotation to my controller action, and in the Startup class I have:

app.Use(async (context, next) =>
        {
            if(context.Session.GetString("user") != null)
            {
                var tk = JsonConvert.DeserializeObject<UserModel>(context.Session.GetString("user"));
                if (!String.IsNullOrEmpty(tk.Token))
                {
                    context.Request.Headers.Add("Authorization", "Bearer " + tk.Token);
                }
                await next.Invoke();
            }
            else
            {
                context.Request.Path = "/Home/Login";
                await next.Invoke();
            }
        });

If I remove the Authorize attribute, I'm able to get the user information and all the claims using

 var A = User.Identity.Name;

And one of the roles is CompanyRole, but I get an "Unauthorized" when I tried to execute that controller action.

stackoverflow.com/questions/40646312/…

Salah Akbari
– Salah Akbari

2020-03-29 04:16:19 +00:00
Commented Mar 29, 2020 at 4:16 — Salah Akbari
– Salah Akbari, Commented Mar 29, 2020 at 4:16

Mehrdad · Accepted Answer · 2020-03-29 05:01:06Z

1

You should consider middleware's priority and register yours before authorization middleware in Startup.cs file.

app.Use(async (context, next) =>
    {
        if(context.Session.GetString("user") != null)
        {
            var tk = JsonConvert.DeserializeObject<UserModel>(context.Session.GetString("user"));
            if (!String.IsNullOrEmpty(tk.Token))
            {
                context.Request.Headers.Add("Authorization", "Bearer " + tk.Token);
            }
            await next.Invoke();
        }
        else
        {
            context.Request.Path = "/Home/Login";
            await next.Invoke();
        }

    });
app.UseAuthorization();

answered Mar 29, 2020 at 5:01

Mehrdad

1,74114 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

ASP.NET Core 3.1 doesn't authorize bearer token

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related