JWT token authentication fails with message "PII is hidden"

Question

in my .net core 2.2 microservice, I try to extract claims from a JWT token to do some authorization. authentication is done on another part of the system so I don't need to do it at this point.

I am using this code in the Startup.cs:

  services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
            .AddJwtBearer(options =>
            {
                var signingKey = Encoding.UTF8.GetBytes("SECRET_KEY");
                options.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = false,
                    ValidateAudience = false,
                    IssuerSigningKey = new SymmetricSecurityKey(signingKey)
                };
            });

On the controller I have this code:

    [Authorize]
    [HttpPost]
    public async Task<ActionResult<CreateResponse>> Create()
    {
        var userIdClaim = HttpContext.User.Claims.Where(x => x.Type == "empId").SingleOrDefault();
        return Ok($"Your User ID is {userIdClaim.Value} and you can create invoices!");
    }

I always get this error message and "Unauthorized" response:

Microsoft.IdentityModel.Tokens.SecurityTokenInvalidSignatureException: IDX10503: Signature validation failed. Keys tried: '[PII is hidden]'. Exceptions caught: '[PII is hidden]'. token: '[PII is hidden]'.

Signature validation fails. Make sure the signing keys are correct. — juunas, Mar 22 '19 at 15:39
Possible duplicate of [JWT SecurityTokenInvalidSignatureException using RS256 PII is hidden](https://stackoverflow.com/questions/50590432/jwt-securitytokeninvalidsignatureexception-using-rs256-pii-is-hidden) — Carlo Bos, May 03 '19 at 18:50

score 45 · Accepted Answer · answered Apr 26 '19 at 14:43

45

You can see the hidden details in development by adding the following to Configure() in the Startup class:

if (env.IsDevelopment())
{
     IdentityModelEventSource.ShowPII = true; 
}

Once you have the full message check the key being used is correct for the token.

answered Apr 26 '19 at 14:43

user1069816

2,763
2
26
43

@Oofpez this works in 2.2 for me, do you have an example of it not working? – user1069816 Jun 19 '19 at 10:13
1

@Oofpez docs suggest it works with the latest version https://learn.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.logging.identitymodeleventsource.showpii?view=azure-dotnet – user1069816 Jun 20 '19 at 14:00
4

I can confirm this is working for 2.2 as well, also ensure that you have ```using Microsoft.IdentityModel.Logging;``` – Alex KeySmith Aug 09 '19 at 16:34
How can I do this in an xunit unit test project? – Jeremy Jan 18 '23 at 23:25

JWT token authentication fails with message "PII is hidden"

1 Answers1

Linked