Validate a JWT from another C# ASP.NET Core 3.1 API that consumes it

Question

So I am getting a JWT from a web call that comes from Service A to secure Service B with the same token. Unfortunately it uses a third party library so I don't know the exact key it issues but I can see it's payload just fine. Is there a way I can make my service know the token is okay somehow? I tried this in Startup.ConfigureServices

services.AddAuthentication()
            .AddJwtBearer(options =>
            {
                options.Events = new JwtBearerEvents
                {
                    OnMessageReceived = context =>
                    {
                        var accessToken = context.Request.Headers["Authorization"].FirstOrDefault()?.Split(" ")?.Last() ?? string.Empty;
                        if (!string.IsNullOrEmpty(accessToken))
                            context.Token = accessToken;

                        return Task.CompletedTask;
                    }
                };
            });

Now this gets the JWT I expect and in a test case let's say this: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0LmNvbSJ9.XzkQ9hQ0JyhQDpFZ00Ukc_5ickUmjxVUBvlMrcEeycw

There is nothing wrong here and the 'context.Token' is getting set, but when I do this:

[Authorize(AuthenticationSchemes = "Bearer")]
[Route("[controller]/[action]")]
public class JobsUpdateController : ControllerBase

I get a 401 no matter what when using the '[Authorize(AuthenticationSchemes="Bearer")]'. Is there anyway I can do a custom authorize? Else I was thinking of doing some long form of setting my own authentication method and maybe making a custom attribute. But I was hoping I could just get the startup working for this if I know the 'issuer' and several other keys in the payload of what I expect.

Why doesn't it have exp expiration time claim? You might have to disable lifetime validation (or other parameters) in options.TokenValidationParameters. It would not be as secure, if at all, given you don't have a public key to validate the signature. — abdusco
– abdusco, Commented Sep 10, 2021 at 13:01
@abdusco Oh it does, ultimately I just want to start small and get one thing working at a time with the smallest example possible. Ultimate I do want to validate the exp, audience, and key as well but I just want to build it one at a time to ensure it's working on the overall [Authorize(AuthenticationSchemes = "Bearer")] on the Controller. — djangojazz
– djangojazz, Commented Sep 10, 2021 at 16:53
Why do you need to hook into OnMessageReceived event? ASP.NET Core extracts the token itself. github.com/dotnet/aspnetcore/blob/… — abdusco
– abdusco, Commented Sep 10, 2021 at 17:09
Don't know, I saw it on a tutorial. Thus far nothing is working. — djangojazz
– djangojazz, Commented Sep 10, 2021 at 17:11

abdusco · Accepted Answer · 2021-09-10 18:57:54Z

1

You can configure JWT validation in options.TokenValidationParameters.

This is NOT secure, and you're basically allowing pretty much any token. But regardless, here it is:

services
    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(
        options => {
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = true, // `iss` claim
                ValidIssuers = new []{"https://localhost:1234"},
                ValidateAudience = false, // `aud` claim
                ValidateLifetime = false, // `exp`, `nbf` claims
                ValidateIssuerSigningKey = false, // signature
                SignatureValidator = (token, parameters) => new JwtSecurityToken(token), // don't validate signature
            };
        });

edited Sep 10, 2021 at 18:57

answered Sep 10, 2021 at 13:07

abdusco

11.3k3 gold badges38 silver badges50 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

djangojazz Over a year ago

It looks like it should work but I still get a 401. Maybe I am doing something wrong on the controller attribute? imgur.com/a/pD4P8OO

djangojazz Over a year ago

The return header says: 'Bearer error="invalid_token", error_description="The signature key was not found"'

abdusco Over a year ago

Try adding a dummy SignatureValidator. See my answer

djangojazz Over a year ago

Yeah still not working whenever I post in at the top of the controller: [Authorize(AuthenticationSchemes = "Bearer")]. Do I need some other scheme?

abdusco Over a year ago

@djangojazz Just tried, my code works with the token you posted when I add SignatureValidator. I can read claims just fine. i.sstatic.net/CXWV6.png. This is the configuration: i.sstatic.net/1F6Ze.png

|

Collectives™ on Stack Overflow

Validate a JWT from another C# ASP.NET Core 3.1 API that consumes it

1 Answer 1

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related