dotnet / dotnet/aspnetcore

Invalid Issuer should response 500 instead of 401 in dotnet 8 Microsoft.AspNetCore.Authentication.JwtBearer

Open
#53,692 2 comments 0 reactions 0 assignees View on GitHub
area-auth bug
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

Microsoft.AspNetCore.Authentication.JwtBearer version 8.0.1

Invalid Issuer should response 500 instead of 401 as before. Invalid Issuer is server-side issue. Response 401 and add comments in header may confuse client-side user who request with valid token.

image

image

image

image

### Expected Behavior

Invalid Issuer is service side issue so response 500 is expected. The server lost token validate function does not mean user credential is incorrect.

### Steps To Reproduce

```
builder.Services.AddAuthentication("Bearer")
.AddJwtBearer("Bearer", config =>
{
config.Authority = "https://authority.host";
config.Audience = "audience-here";

config.SaveToken = true;
});
```
set up Web API project and request with valid token. **Disconnect all network connection to Authority.**
I have test 3.1, 6, 7, 8 and only response code 401 received in dotnet 8.

### Exceptions (if any)

_No response_

### .NET Version

8.0.101

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.