dotnet / dotnet/AspNetCore.Docs
"Authentication and authorization in minimal APIs" documentation unclear configuration options
- Dominant language
- C#
- Stars
- 13.1k
- Forks
- 24.6k
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 97
Description
I was testing out setting up JWT bearer auth for a minimal .NET 7 API without using my own options/configuration section by trying to follow the documentation on this page: https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis/security?view=aspnetcore-7.0#configuring-authentication-strategy
I ended up getting the following validation failure on the bearer token when calling an endpoint `Bearer was not authenticated. Failure message: IDX10501: Signature validation failed. Unable to match key`.
The issue in this case was the `Authority` not being set on the options (the error message isn't particularly helpful).
I ended up having to look at the source code for the [JwtBearerConfigureOptions](https://github.com/dotnet/aspnetcore/blob/c5a9c5973bf735f1bb9d611cd50c796f6c32557e/src/Security/Authentication/JwtBearer/src/JwtBearerConfigureOptions.cs#L56) class to find out how I could configure this setting.
I think the documentation sample should be updated to include/reference this options class (or all the properties loaded from config into it) so developers know what values can be defined in configuration.
Furthermore, the example on that minimal API page should probably be updated to define the `Authority` property, as that's the most common configuration used when setting up JWT bearer auth to my understanding.
When using a user defined custom config section/option, the auth configuration usually looks something like this:
```c#
builder.Services.AddAuthentication(options =>
{
options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
}).AddJwtBearer(options =>
{
var jwtOptions = builder.Configuration.GetRequiredSection("MyJwtSettings").Get();
ArgumentNullException.ThrowIfNull(jwtOptions);
options.Authority = jwtOptions.Issuer;
options.Audience = jwtOptions.Audience;
});
```
If the framework provided option is configured correctly in appsettings you do not need the above and can simply do
`builder.Services.AddAuthentication().AddJwtBearer();`
---
#### Document Details
⚠ *Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.*
* ID: 3a9d7eb8-6c1f-4619-00fa-9b69dbe3dcea
* Version Independent ID: 3a9d7eb8-6c1f-4619-00fa-9b69dbe3dcea
* Content: [Authentication and authorization in minimal APIs](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis/security?view=aspnetcore-7.0#configuring-authentication-strategy)
* Content Source: [aspnetcore/fundamentals/minimal-apis/security.md](https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/fundamentals/minimal-apis/security.md)
* Product: **aspnet-core**
* Technology: **aspnetcore-fundamentals**
* GitHub Login: @captainsafia
* Microsoft Alias: **safia**
Contributor guide
Assessment
This issue has not been assessed yet.