dotnet / dotnet/AspNetCore.Docs

AddJwtBearer(scheme) cannot be overriden due to hard coded implementation with "Bearer"

Open
#33,473 3 comments 0 reactions 1 assignee Claimed by @adityamandaleeka View on GitHub
aspnet-core/svc fundamentals/subsvc Security-PU Source - Docs.ms
Dominant language
C#
Stars
13.1k
Forks
24.6k
Avg merge
1d 3h
Merged PRs (30d)
97

Description

### Description

The documentation says `"Bearer" is the typical default scheme in JWT-bearer based enabled apps, but the default scheme can be overridden by setting the DefaultScheme property as in the preceding example.` and gives us an example:

```cs
var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication()
.AddJwtBearer()
.AddJwtBearer("LocalAuthIssuer");

var app = builder.Build();

app.MapGet("/", () => "Hello World!");
app.Run();
```

However, the `JwtBearerHandler` is hard coded to `Bearer` scheme, rendering the `.AddJwtBearer(scheme)` extension method pretty much useless: https://github.com/dotnet/aspnetcore/blob/258f8baa683db26ea46a00618a8b9b4d8db764b4/src/Security/Authentication/JwtBearer/src/JwtBearerHandler.cs#L84

### Page URL

https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis/security?view=aspnetcore-8.0&source=docs

### Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/fundamentals/minimal-apis/security.md

### Document ID

3a9d7eb8-6c1f-4619-00fa-9b69dbe3dcea

### Article author

@captainsafia

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.