c# - JWT on .NET Core 2.0 -

i've been on quite adventure jwt working on dotnet core 2.0 (now reaching final release today). there ton of documentation, sample code seems using deprecated apis , coming in fresh core, it's positively dizzying figure out how it's supposed implemented. tried using jose, app. usejwtbearerauthentication has been deprecated, , there no documentation on next.

does have open source project uses dotnet core 2.0 can parse jwt authorization header , allow me authorize requests hs256 encoded jwt token?

the class below doesn't throw exceptions, no requests authorized, , no indication why unauthorized. responses empty 401's, me indicates there no exception, secret isn't matching.

one odd thing tokens encrypted hs256 algorithm, see no indicator tell force use algorithm anywhere.

here class have far:

using system; using system.collections.generic; using system.io; using microsoft.aspnetcore.authentication; using microsoft.aspnetcore.authentication.jwtbearer; using microsoft.aspnetcore.builder; using microsoft.aspnetcore.hosting; using microsoft.aspnetcore.http; using microsoft.extensions.configuration; using microsoft.extensions.dependencyinjection; using microsoft.net.http.headers; using newtonsoft.json.linq; using microsoft.identitymodel.tokens; using system.text;  namespace site.authorization {     public static class siteauthorizationextensions     {         public static iservicecollection addsiteauthorization(this iservicecollection services)         {             var signingkey = new symmetricsecuritykey(encoding.ascii.getbytes("secret_key"));              var tokenvalidationparameters = new tokenvalidationparameters             {                 // signing key must match!                 validateissuersigningkey = true,                 validateaudience = false,                 validateissuer = false,                 issuersigningkeys = new list<securitykey>{ signingkey },                   // validate token expiry                 validatelifetime = true,             };              services.addauthentication(options =>             {                 options.defaultauthenticatescheme = jwtbearerdefaults.authenticationscheme;                 options.defaultchallengescheme = jwtbearerdefaults.authenticationscheme;               })              .addjwtbearer(o =>             {                 o.includeerrordetails = true;                 o.tokenvalidationparameters  = tokenvalidationparameters;                 o.events = new jwtbearerevents()                 {                     onauthenticationfailed = c =>                     {                         c.noresult();                          c.response.statuscode = 401;                         c.response.contenttype = "text/plain";                          return c.response.writeasync(c.exception.tostring());                     }                  };             });              return services;         }     } } 

my tokenvalidationparameters works when this:

var tokenvalidationparameters = new tokenvalidationparameters         {             validateissuersigningkey = true,             issuersigningkey = getsigninkey(),             validateissuer = true,             validissuer = getissuer(),             validateaudience = true,             validaudience = getaudience(),             validatelifetime = true,             clockskew = timespan.zero,         }; 

and

    static private symmetricsecuritykey getsigninkey()     {         const string secretkey = "very_long_very_secret_secret";         var signingkey = new symmetricsecuritykey(encoding.utf8.getbytes(secretkey));          return signingkey;     }      static private string getissuer()     {         return "issuer";     }      static private string getaudience()     {         return "audience";     } 

moreover, add options.requirehttpsmetadata = false this:

         .addjwtbearer(options =>        {                     options.tokenvalidationparameters =tokenvalidationparameters                     options.requirehttpsmetadata = false;        }); 

edit:

dont forget call

 app.useauthentication(); 

in startup.cs -> configure method before app.usemvc();