I am facing an interesting problem. I'm using Microsoft.AspNetCore.Authentication.JwtBearer version 3.0.3 in a .Net Core 3.0 application and interestingly, the requests sometimes returns 401 without a logical reason. After logging the requests I see that context.HttpContext?.User?.Claims is empty, but I can get the related token by typing context.HttpContext.Request.Headers["Authorization"].
I have readed the link below and i know there is vulnerability in this library but i don't think it's the reason of this stiuation. https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.JwtBearer/3.0.3
The services are running on docker. And this problem started to appear in the last 1 week and there was no update in the places related to the token. It redirects all requests to other servers through NGINX itself.
I thought NGINX causes the problem and i increased the client_max_body_size but it didn't work.
I can get successful results when I send the token I logged to the same service via Postman.
As a result I still couldn't find the problem
Below is JWT configurations
services.AddAuthentication(x =>
{
x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(x =>
{
x.RequireHttpsMetadata = false;
x.SaveToken = false;
x.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuerSigningKey = true,
IssuerSigningKey = new SymmetricSecurityKey(key),
ValidateIssuer = false,
ValidateAudience = false
};
});