Agfdhyk

I am doing a project where i have a separate front- and backend, and i want to protect my backend API with JWT bearer tokens.

When i send a get request from postman without any tokens attached, the API always return 200 OK. The debug console confirms that the Authorization middleware was not invoked. I do however get a HTTPS error??
Below is a link to an image of my console (new users can't have pictures directly in a question).

My console

I've looked at this guy's simple example of what i need exactly. His works no problem, and the console of his app shows authorization getting invoked, and i get 401 Unauthorized. When i use his approach nothing happens and i always get 200 OK.

In startup.cs i have both tried using services.AddMvc() as seen below, but also services.AddMvcCore().AddAuthorization(). Both resulted in Authorization not being invoked

Here is my startup.cs:

namespace API

{

public class Startup

{

    public Startup(IConfiguration configuration)

    {

        Configuration = configuration;

    }



    public IConfiguration Configuration { get; }



    // This method gets called by the runtime. Use this method to add services to the container.

    public void ConfigureServices(IServiceCollection services)

    {

        services.AddCors();

        services.AddMvc();



        services.AddAuthentication(options =>

            {

                options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;

                options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;

            })

            .AddJwtBearer(options =>

            {

                options.RequireHttpsMetadata = false;

                options.SaveToken = true;

                options.TokenValidationParameters = new TokenValidationParameters

                {

                    ValidateIssuer = true,

                    ValidateAudience = false,

                    ValidateLifetime = true,

                    ValidateIssuerSigningKey = true,

                    ValidIssuer = Configuration["Jwt:Issuer"],

                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:Key"]))

                };

            });



        var connection = Environment.GetEnvironmentVariable("DB");

        services.AddDbContext<CoPassContext>(options => options.UseSqlServer(connection));

        services.AddScoped<IRepository, Repository>();

    }



    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.

    public void Configure(IApplicationBuilder app, IHostingEnvironment env)

    {

        if (env.IsDevelopment())

        {

            app.UseDeveloperExceptionPage();

        }

        else

        {

            app.UseHsts();

        }



        app.UseCors(c => c

            .AllowCredentials()

            .AllowAnyHeader()

            .AllowAnyMethod()

            .AllowAnyOrigin());



        app.UseAuthentication();

        app.UseMvc();

    }

}

}

Here is a controller:

[Authorize]

[ApiController]

[Microsoft.AspNetCore.Mvc.Route("api/[controller]")]

public class CompanyController : ControllerBase

{

    private IDAO dao;



    public CompanyController(IDAO db)

    {

        dao = db;

    }



    [Microsoft.AspNetCore.Mvc.HttpGet("search/{keyword}")]

    public ActionResult<string> SearchCompanies(string keyword)

    {

        return JsonConvert.SerializeObject(dao.SearchCompanies(keyword));

    }



    // GET api/company/basic/5

    [Microsoft.AspNetCore.Mvc.HttpGet("basic/{id}")]

    public ActionResult<string> GetBasic(string id)

    {

        return dao.GetCompanyByRegNrBasic(id).ToString();

    }

It looks like you forgot to add the authorization.

Like @ste-fu said, try add this below the services.AddAuthentication(..);

services.AddAuthorization();

With Mvc Core 2.2 instead of using services.AddAuthorization(); do services.AddMvcCore().SetCompatibilityVersion(CompatibilityVersion.Version_2_2).AddJsonFormatters().AddAuthorization();
all in one chained line.