Asp.net Jwt token validation

Question

ASP.NET Core 2.x has a really nice way to add Bearer Authentication using JWT tokens. The following code is the minimum requirement to make things work.

{
    TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidIssuer = "https://issuer.com",
        ValidateLifetime = true,
    }
});

I understand the anatomy of a JWT header.payload.signature but in case we are using an Asymmetric algorithm, we need to validate the signature and for that we need to get the public keys from this url: issuer + .well-known/jwks.json.

So, is the middleware "magically" fetching the public keys and validating the signature? Also, is the middleware caching the public keys to avoid fetching the public keys in every validation?

Have you looked at TokenValidationParameters IssuerSigningKey property? — Jonathon Chase
– Jonathon Chase, Commented Jun 4, 2019 at 17:08
Well, I know that property and also the IssuerSigningKeyResolver my question is about the public keys caching. — Marco Talento
– Marco Talento, Commented Jun 4, 2019 at 22:30

Nan Yu · Accepted Answer · 2019-06-05 05:25:59Z

3

The ConfigurationManager object is responsible for retrieving, refreshing and caching the configuration metadata required to validate JWTs, such as the issuer and signing keys . Middleware will retire the metadata and cahche when the first time authentication begins , see source code here .

answered Jun 5, 2019 at 5:25

Nan Yu

27.7k9 gold badges75 silver badges157 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Marco Talento Over a year ago

Thank you! What happens when the token provider rotates the public keys?

Nan Yu Over a year ago

@MarcoTalento ,middleware will refresh the configuration for exceptions that may be caused by key rollovers , see source code

Marco Talento Over a year ago

Thank you very much, this is exactly what I was looking for! I forgot that asp.net core is open source now! Unfortunately, there is no similar mechanism in .net framework 4.x provided by the framework.

Collectives™ on Stack Overflow

Asp.net Jwt token validation

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related