Asp.net Core授权用户使用策略

Question

I am trying to authorize an user with a bearer token send from the request header. I added this code in startup file of resource server.

services.AddAuthorization(auth =>
{
   auth.AddPolicy("Bearer", new AuthorizationPolicyBuilder()                        
  .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme)
  .RequireAuthenticatedUser().Build());
});

Here is my method in controller.

[Authorize("Bearer")]
[HttpGet]
[Route("list")]
public IEnumerable<Products> List()
{
    string Authorization = Request.Headers["Authorization"];
}

Application showing me error 401 Unauthorized even if i had token

I am sending this Token in the header request

Authorization:Bearer "xyz"

Answer 1

To work with Bearer token you have to add the following code on your Configure method

public void Configure(IApplicationBuilder app) {
    app.UseJwtBearerAuthentication(options => {
        options.AutomaticAuthenticate = true;
        options.AutomaticChallenge = true;
        options.Audience = "OAuth:Audience";
        options.Authority = "OAuth:Authority";
        options.ConfigurationManager = new ConfigurationManager<OpenIdConnectConfiguration>(
            metadataAddress: options.Authority + ".well-known/openid-configuration",
            configRetriever: new OpenIdConnectConfigurationRetriever(),
            docRetriever: new HttpDocumentRetriever() { RequireHttps = false });
    });
}

You will also need a middleware to handle the authorization process. Have a look at AspNet.Security.OpenIdConnect.Server and OpenIddict