UseJwtBearerAuthentication returns 401

Question

I'm using Firebase and dotnet core in my application stack.

I'm generating a JWT fine using the Firebase iOS API and can confirm that the structure is as expected and valid using jwt.io's parser.

The Setup

I've followed this article to setup dotnet core to automatically set principal based on the request.

The configure method of my Startup file looks like this, where in practice the part is replaced by the project app (which I can confirm is the same as the aud property in my parsed JWT as seen on jwt.io):

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
    loggerFactory.AddConsole(Configuration.GetSection("Logging"));
    loggerFactory.AddDebug();
    loggerFactory.AddSerilog();

    app.UseJwtBearerAuthentication(new JwtBearerOptions
    {
        AutomaticAuthenticate = true,
        IncludeErrorDetails = true,
        Authority = "https://securetoken.google.com/",
        TokenValidationParameters = new TokenValidationParameters
        {  
            ValidateIssuer = true,
            ValidIssuer = "https://securetoken.google.com/",
            ValidateAudience = true,
            ValidAudience = "",
            ValidateLifetime = true,
        },
    });

    app.UseMvc();
}

The Request

I have a controller action that I can hit at the url http://localhost:5000/api/dashboard and get the expected response when I don't have the Authorize attribute on the controller. I have then added the Authorize attribute back so I can start testing the JWT middleware.

I'm creating a request in Postman as seen in this picture:

The Response

As you can see in the picture above the response is a 401 Unauthorized.

The server logs in my debug output look like this.

info: Microsoft.AspNetCore.Hosting.Internal.WebHost[1]
      Request starting HTTP/1.1 GET http://localhost:5000/api/dashboard  
Microsoft.AspNetCore.Hosting.Internal.WebHost:Information: Request starting HTTP/1.1 GET http://localhost:5000/api/dashboard  
info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[2]
      Authorization failed for user: (null).
Microsoft.AspNetCore.Authorization.DefaultAuthorizationService:Information: Authorization failed for user: (null).
info: Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker[1]
      Authorization failed for the request at filter 'Microsoft.AspNetCore.Mvc.Authorization.AuthorizeFilter'.
Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker:Information: Authorization failed for the request at filter 'Microsoft.AspNetCore.Mvc.Authorization.AuthorizeFilter'.
info: Microsoft.AspNetCore.Mvc.ChallengeResult[1]
      Executing ChallengeResult with authentication schemes ().
Microsoft.AspNetCore.Mvc.ChallengeResult:Information: Executing ChallengeResult with authentication schemes ().
info: Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerMiddleware[12]
      AuthenticationScheme: Bearer was challenged.
Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerMiddleware:Information: AuthenticationScheme: Bearer was challenged.
info: Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker[2]
      Executed action Sured.Api.Controllers.DashboardController.Get (Sured.Api) in 20.2369ms
Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker:Information: Executed action Sured.Api.Controllers.DashboardController.Get (Sured.Api) in 20.2369ms
info: Microsoft.AspNetCore.Hosting.Internal.WebHost[2]
      Request finished in 37.6488ms 401

The Question

I've been researching on Google and trawling through source code and I simply can't crack this.

Can anyone see what I am doing wrong here?

For good measure, here's all the dependency versions in my project:

UseJwtBearerAuthentication returns 401

The Setup

The Request

The Response

The Question

2 Answers