A jwt.io verified JWT failed in C# by using UseJwtBearerAuthentication - oauth

Question

I have the following JWT token
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwOi8vbG9jYWxob3N0IiwiYXVkIjoiRDFDOTBCRUUtOEM1NC00RDZCLThENDYtOTU5NkJGQjRGMjhCIiwic3ViIjoiMTAwMCJ9.GdVBv2LPqKi1NmwPnnaGq6jz5WMLNkQOG9WttoH6Nfw=
and the secret is
BE7B9DD1-6197-4684-A232-5D680812ADC3
We get the following if we base64encode the secret
QkU3QjlERDEtNjE5Ny00Njg0LUEyMzItNUQ2ODA4MTJBREMz
It verifies with signature in jwt.io
The header is decoded to
{
"typ": "JWT",
"alg": "HS256"
}
and the payload
{
"iss": "http://localhost",
"aud": "D1C90BEE-8C54-4D6B-8D46-9596BFB4F28B",
"sub": "1000"
}
It's all good. I've learned from the following articles
https://auth0.com/docs/server-apis/webapi-owin and
http://bitoftech.net/2014/10/27/json-web-token-asp-net-web-api-2-jwt-owin-authorization-server/
so the code I have in my Startup.ConfigureOAuth() is just a copy from theirs (Can't remember which one I saw first):
var issuer = "http://localhost";
var audience = "D1C90BEE-8C54-4D6B-8D46-9596BFB4F28B";
var secret = TextEncodings.Base64Url.Decode("BE7B9DD1-6197-4684-A232-5D680812ADC3");
// Api controllers with an [Authorize] attribute will be validated with JWT
app.UseJwtBearerAuthentication(
new JwtBearerAuthenticationOptions
{
AuthenticationMode = AuthenticationMode.Active,
AllowedAudiences = new[] { audience },
IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[]
{
new SymmetricKeyIssuerSecurityTokenProvider(issuer, secret)
},
Provider = new OAuthBearerAuthenticationProvider
{
OnValidateIdentity = context =>
{
context.Ticket.Identity.AddClaim(new System.Security.Claims.Claim("newCustomClaim", "newValue"));
return Task.FromResult<object>(null);
}
}
});
I tired with both Provider and without Provider. But all I got is 401 and the following
{
"Message": "Authorization has been denied for this request."
}
I know my JWT is correct since jwt.io can decode it just fine. Can someone please spot my error or if I should do it differently.

Answer 1

You have copied code from examples that pull base64url encoded secrets from the configuration. Yet in your case the secret is in plain text. So just use:
var secret = "BE7B9DD1-6197-4684-A232-5D680812ADC3";
jwt.io shows that the secret used to sign the JWT you provided was actually the base64encoded variant QkU3QjlERDEtNjE5Ny00Njg0LUEyMzItNUQ2ODA4MTJBREMz that should have been base64decoded first.