I think this could be reproduced on any .NET 6 capable machine, within 1-2 minutes...
Context
I am trying the get work the ASP.NET Core 6 React SPA template with Identity authentication. Based on the Authentication and authorization for SPAs which is updated a few days ago I had run:
dotnet new react -au Individual
I did not modify the application, according the corresponding web page, it is not necessary. As far I understand, the MVC part is providing the UI for sign-in + have a protected API for Weather.
The app launches, and I successfully register a new user, and successfully log in and out. The UI for this is provided by MS Identity within the application, backed by Duende.IdentityServer assemblies. The client React SPA also seems working, for example Counter page works.
However the only interesting part (for me), the JWT, where the React SPA calls the API after acquired a valid JWT token does not work. This is the Fetch data page.
Debugging with Fiddler, I see the HTTP 401, with Bearer error="invalid_token", error_description="The issuer 'https://localhost:44412' is invalid"
Although I understand what this mean, both the React App and both the API runs on https://localhost:44412, who else could be the expected issuer than https://localhost:44412?
Also the dozens page article not even mentions any necessary modification in the generated template.
Question
What am I missing here. Obviously I am not an authentication expert, the whole idea would be to quickly got and idea by learning from a working best practice example...