dotnet / dotnet/aspnetcore

SignalR JS w/ Azure SignalR Service incorrectly sends Azure SignalR JWT to application.

Open
#65,620 5 comments 2 reactions 2 assignees Claimed by @BrennanConroy View on GitHub
area-signalr
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 5h
Merged PRs (30d)
276

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

- Have a simple ASP.NET Core web server with a mapped SignalR hub
- Support both Cookie and JWT auth on the web server
- Use `.AddAzureSignalR` on the server.
- Connect to the hub with `@microsoft/signalr` JS, observe it correctly negotiates over to use Azure SignalR service.
- Lose connectivity, e.g. by setting browser network tools offline and waiting 30-60 seconds.
- Observe that reconnect/retry calls to `/negotiate` against the application server (NOT the /negotiate to Azure SignalR) now include a JWT. This JWT's audience is `https://my-signalr-service.service.signalr.net/client/?hub=myhub`, but is being sent to my application server. This confuses my application server that also happens to accept JWTs for other, signalr-unrelated purposes because this JWT is not valid for the validation parameters of my server (invalid audience, for one).

### Expected Behavior

JWTs obtained for Azure SignalR Service are never sent back to the original application server in /negotiate calls. These JWTs are only meant for Azure SignalR Service and should therefore only be sent to Azure SignalR Service endpoints.

### Steps To Reproduce

https://github.com/ascott18/2026-03-02-azure-signalr-wrong-jwt

### Exceptions (if any)

_No response_

### .NET Version

10.0.200-preview.0.26103.119

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.