Invalid Issuer should response 500 instead of 401 in dotnet 8 Microsoft.AspNetCore.Authentication.JwtBearer
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the bug
Microsoft.AspNetCore.Authentication.JwtBearer version 8.0.1
Invalid Issuer should response 500 instead of 401 as before. Invalid Issuer is server-side issue. Response 401 and add comments in header may confuse client-side user who request with valid token.
### Expected Behavior
Invalid Issuer is service side issue so response 500 is expected. The server lost token validate function does not mean user credential is incorrect.
### Steps To Reproduce
```
builder.Services.AddAuthentication("Bearer")
.AddJwtBearer("Bearer", config =>
{
config.Authority = "https://authority.host";
config.Audience = "audience-here";
config.SaveToken = true;
});
```
set up Web API project and request with valid token. **Disconnect all network connection to Authority.**
I have test 3.1, 6, 7, 8 and only response code 401 received in dotnet 8.
### Exceptions (if any)
_No response_
### .NET Version
8.0.101
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.