Authorizing Access with JWT tokens in asp.net mvc website - asp.net-mvc

Question

I would like to use jwt tokens for authorization in my ASP.NET MVC website. I have already created an api that generates the jwt token from this tutorial :
https://www.c-sharpcorner.com/article/asp-net-web-api-2-creating-and-validating-jwt-json-web-token/
Now I have added the following nuget packages in my asp.net mvc website :
System.IdentityModel.Tokens.Jwt 5.5.0
Microsoft.Owin.Security.Jwt 4.0.1
Microsoft.AspNet.WebApi.Owin 5.2.3
Microsoft.Owin.Host.SystemWeb 4.0.1
And I have also created a startup file and inserted the following code:
app.UseJwtBearerAuthentication(
new JwtBearerAuthenticationOptions
{
AuthenticationMode = AuthenticationMode.Active,
TokenValidationParameters = new TokenValidationParameters()
{
ValidateIssuer = true,
ValidateAudience = true,
ValidateIssuerSigningKey = true,
ValidIssuer = "example.com", //some string, normally web url,
ValidAudience = "example.com",
IssuerSigningKey = new
SymmetricSecurityKey(Encoding.UTF8.GetBytes("my_secret_key_12345"))
}
});
I am then using postman to create a jwt token and challenge the website for authorization.
The generate token method is the following. (literally like the tutorial):
public Object GetToken()
{
string key = "my_secret_key_12345";
var issuer = "example.com"; //normally this will be your site URL
var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(key));
var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256);
//Create a List of Claims, Keep claims name short
var permClaims = new List<Claim>();
permClaims.Add(new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()));
permClaims.Add(new Claim("valid", "1"));
permClaims.Add(new Claim("userid", "1"));
permClaims.Add(new Claim("name", "bilal"));
//Create Security Token object by giving required parameters
var token = new JwtSecurityToken(issuer, //Issure
issuer, //Audience
permClaims,
expires: DateTime.Now.AddDays(1),
signingCredentials: credentials);
var jwt_token = new JwtSecurityTokenHandler().WriteToken(token);
return new { data = jwt_token };
}
I have created the following method to challenge the authorization:
[Authorize]
public string checkbystring()
{
return "worked";
}
But when I test it in postman, the following error keeps popping up:
IIS 10.0 Detailed Error - 401.0 - Unauthorized
Any suggestions to make this work would be highly appreciated.

Answer 1

I was facing a similar problem in ASP NET MVC, my token was generated, but when I used it I got the 401 error.
I needed to create an ASP NET MVC application, which used JWT token, but not Core.
The solution in my case was to include a library that was missing:
Microsoft.Owin.Host.SystemWeb
using Microsoft.IdentityModel.Tokens;
using Microsoft.Owin;
using Microsoft.Owin.Security;
using Microsoft.Owin.Security.Jwt;
using Owin;
using System.Text;
[assembly: OwinStartup(typeof(WebAPI.Startup))]
namespace WebAPI
{
public class Startup
{
private readonly string SecuretyKey = "KEY--$%TESTE&##&#";
public void Configuration(IAppBuilder app)
{
app.UseJwtBearerAuthentication(
new JwtBearerAuthenticationOptions
{
AuthenticationMode = AuthenticationMode.Active,
TokenValidationParameters = new TokenValidationParameters()
{
ValidAudience = "Teste.com",
ValidIssuer = "Teste.com",
IssuerSigningKey = new SymmetricSecurityKey(
Encoding.UTF8.GetBytes(SecuretyKey)),
ValidateLifetime = true,
ValidateIssuerSigningKey = true
}
});
}
}
}
In addition to it, the image of the other necessary packages follows.
enter image description here