.NET Core API - does the middleware set the JWT bearer token in the header?

Question

I've got all the code working to generate the JWT and I've wired up my ConfigureServices with the proper config code but I'm not seeing the header actually get set.

I assumed that the middleware would do this for you but maybe not, is it up to me to return the token from the login method of my controller and the client to then take it and set the header for subsequent requests?

Answer 1

No it does not.

The way it works is that you send your login credentials to a login server. In most cases its the same but in more secure applications this won't be the case.

The server then authenticates your credentials, creates a JWT token and sends that back to you.

You can then use that JWT in your header when making a request to the application server:

"Authorization":"Bearer xxxxx.yyyyy.zzzzz"

This needs to be done with every call to the server because the point of JWT is that it is stateless, meaning the server does not save the data at all. Instead in reads the JWT token with every call and grants access/functionality based on that.