Add custom validation to JWT token for ASP.NET Core?

Question

Previously, I was able to use JwtBearerAuthenticationOptions to add my custom token handler with my custom validation. Now with Core UseJwtBearerAuthentication I need to use JwtBearerOptions which doesn't seem to have an option to override JwtSecurityTokenHandler. I basically want to override the following method in JwtSecurityTokenHandler:

protected virtual JwtSecurityToken ValidateSignature(string token, TokenValidationParameters validationParameters)

Previously:

app.UseJwtBearerAuthentication(new JwtBearerAuthenticationOptions
{
    TokenHandler = new MyTokenHandler()
    // other properties here
});

Currently with ASP.NET Core:

app.UseJwtBearerAuthentication(new JwtBearerOptions
{
    // other properties here
});

Sock · Accepted Answer · 2016-08-27 00:58:38Z

19

If you want to actually create your own JwtSecurityTokenHandler and override the ValidateSignature method, you can use the SecurityTokenValidators property:

var options new JwtBearerOptions();
options.SecurityTokenValidators.Clear();
options.SecurityTokenValidators.Add(new MyTokenHandler());
app.UseJwtBearerAuthentication(options);

Technically the call to Clear() isn't necessary - as long as one of the token handlers can parse the token the call to authenticate will succeed. However removing the JwtSecurityTokenHandler seems to make sense if it won't ever succeed in your case.

answered Aug 27, 2016 at 0:58

Sock

5,4231 gold badge25 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

AliRıza Adıyahşi Over a year ago

This line options.SecurityTokenValidators.Clear(); save my times. Thanks a lot

Ganesh Over a year ago

How I can return error from Customer token handler - ValidateToken Method?

adem caglin · Accepted Answer · 2016-08-26 18:00:42Z

0

JwtBearerOptions has a parameter named TokenValidationParameters, so you can use this parameter:

var tokenValidationParameters = new TokenValidationParameters
{
    ValidateIssuerSigningKey = true,
    IssuerSigningKey = signingKey,
    //...
};

app.UseJwtBearerAuthentication(new JwtBearerOptions
{
    //...
    TokenValidationParameters = tokenValidationParameters
});

answered Aug 26, 2016 at 18:00

adem caglin

24.5k10 gold badges65 silver badges80 bronze badges

4 Comments

Jeremy Over a year ago

Yea I looked at TokenValidationParameters but couldn't figure out how to do my own token validation. In particular I want to validate the signature and I can't figure out how to do that with TokenValidationParameters.

adem caglin Over a year ago

Are you getting an error? If no what is your token validation logic, could you post it?

Jeremy Over a year ago

I'm not getting an error. There just isn't a TokenHandler property in JwtBearerOptions like there was in JwtBearerAuthenticationOptions.

Oliver Konig Over a year ago

@Jeremy: Can be done with TokenValidationParameters.SignatureValidator. I've done that, it's working.

Collectives™ on Stack Overflow

Add custom validation to JWT token for ASP.NET Core?

2 Answers 2

2 Comments

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related