Why isn't ASP.NET Middleware validating token?

Question

I am trying to validate a JWT token being passed onto a C# application. I confirmed that the token is being sent with every request. If I decode it manually everything works fine (I see the claims). However when I enable Authorization I get a 404 from the (Angular) client when I try to access the page. My theory is that Angular is sending an OPTIONS request that is failing because it cant Auth with the token properly. Any advice on how to confirm this is the issue, and troubleshoot it?

Auth via claim in token

[Authorize(Policy = "IsEmployee")]
[HttpGet("TestTokenAccess")]
public JsonResult TestTokenAccess()
{
    return Json("token decoded. you have claim IsEmployee=yes");
}

Manual token decode

[HttpGet("TestDecodeToken")]
public JsonResult TestDecodeToken()
{
    //https://shellmonger.com/2015/07/18/decoding-an-auth0-json-web-token-with-c/
    if (this.HttpContext.Request.Headers.ContainsKey("Authorization"))
    {
        var authHeader = this.HttpContext.Request.Headers["Authorization"];
        var authBits = authHeader.ToString().Split(' ');
        if (authBits.Length != 2)
        {
            return Json("{error:\"auth bits needs to be length 2\"}");
        }
        if (!authBits[0].ToLowerInvariant().Equals("bearer"))
        {
            return Json("{error:\"authBits[0] must be bearer\"}");
        }

        var secret = "xxxxx";

        //Install-Package JWT -Version 4.0.0
        try
        {
            var json = new JwtBuilder()
                .WithSecret(secret)
                //.MustVerifySignature()
                .Decode(authBits[1]);
            return Json(json);
        }
        catch (TokenExpiredException)
        {
            return Json("Token has expired");
        }
        catch (SignatureVerificationException)
        {
            return Json("Token has invalid signature");
        }
        catch (Exception e)
        {
            return Json($"other token err: {e.Message}");
        }

    }
    return Json("no token");
}

Startup.cs inside of ConfigureServices, but above the AddMVC() call

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.Authority = Configuration["JwtIssuer"];
        options.Audience = Configuration["JwtIssuer"];

        options.RequireHttpsMetadata = true;
        options.SaveToken = true;
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = Configuration["JwtIssuer"],
            ValidAudience = Configuration["JwtIssuer"],
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["JwtKey"]))
        };
    }
);

services.AddAuthorization(options =>
{
    options.AddPolicy("IsEmployee", policy => policy.Requirements.Add(new IsEmployeeRequirement("yes")));

});

services.AddSingleton<IAuthorizationHandler, IsEmployeeAuthorizationHandler>();

appsettings.json

  "JwtKey": "xxx",
  "JwtIssuer": "http://localhost:44362/",
  "JwtExpireDays": 30

snippet from web.config enable CORS

<!--added to enable CORS for Angular-->

<httpProtocol>

  <customHeaders>
    <add name="Access-Control-Allow-Origin" value="https://localhost:44362/" />

    <add name="Access-Control-Allow-Headers" value="Content-Type" />

    <add name="Access-Control-Allow-Methods" value="GET, POST, PUT, DELETE, OPTIONS" />
  </customHeaders>

</httpProtocol>

I assume u are getting 401(Unauthorized) , cuz 404 mean not found which doesn't make much sense here, If you're using IS4 , you better check the logs and see what's wrong with your token validation — Coder1409, Oct 10 '18 at 15:37
@Coder1409, nope I unfortunately mean 404.. my theory is that Angular is sending an OPTIONS request that is failing... I will edit my post to make that clearer — Rilcon42, Oct 10 '18 at 16:45
Did you enabled CORS? https://enable-cors.org/server_aspnet.html — Vinit, Oct 10 '18 at 17:20
Do you have app.UseAuthentication(); in your StatuUp Configure? — Deivid Carvalho, Oct 10 '18 at 17:37
@Vinit Yep I have CORS enabled, and I added the snippet above. Thanks for the reminder! — Rilcon42, Oct 10 '18 at 17:57

score 0 · Answer 1 · answered Oct 11 '18 at 18:23

Turned out my issue was an incorrectly specified claim in Startup.ConfigureServices() I needed to have:

services.AddAuthorization(options =>
{
    options.AddPolicy("IsEmployee", policy =>policy.RequireClaim("IsEmployee", "Yes", "yes"));          
});

rather than the policy specific way Microsoft used in their example here. I also removed the AddSingleton() line because it is not necessary

Why isn't ASP.NET Middleware validating token?

1 Answers1