title: ASP.NET Core Authorize attribute not working with JWT
body: <p>I want to implement JWT-based security in ASP.Net Core. All I want it to do, for now, is to read bearer tokens in the <code>Authorization</code> header and validate them against my criteria. I don't need (and don't want) to include ASP.Net Identity. In fact, I'm trying to avoid using as many of the things that MVC adds in as possible unless I really need them.</p>
  
  <p>I've created a minimal project, which demonstrates the problem. To see the original code, just look through the edit history. I was expecting this sample to reject all requests for <code>/api/icons</code> unless they provide the <code>Authorization</code> HTTP header with a corresponding bearer token. The sample <strong><em>actually allows all requests</em></strong>.</p>
  
  <p>Startup.cs</p>
  
  <pre><code>using Microsoft.AspNetCore.Builder;
  using Microsoft.AspNetCore.Hosting;
  using Microsoft.Extensions.DependencyInjection;
  using Microsoft.Extensions.Logging;
  using Microsoft.Extensions.Configuration;
  using Microsoft.AspNetCore.Routing;
  using Microsoft.IdentityModel.Tokens;
  using System.Text;
  using System;
  using Newtonsoft.Json.Serialization;
  
  namespace JWTSecurity
  {
      public class Startup
      {
          public IConfigurationRoot Configuration { get; set; }
  
          public Startup(IHostingEnvironment env)
          {
              IConfigurationBuilder builder = new ConfigurationBuilder().SetBasePath(env.ContentRootPath);
              Configuration = builder.Build();
          }
  
          public void ConfigureServices(IServiceCollection services)
          {
              services.AddOptions();
              services.AddAuthentication();
              services.AddMvcCore().AddJsonFormatters(options =&gt; options.ContractResolver = new CamelCasePropertyNamesContractResolver());
          }
  
          public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
          {
              loggerFactory.AddConsole();
              app.UseJwtBearerAuthentication(new JwtBearerOptions
              {
                  AutomaticAuthenticate = true,
                  AutomaticChallenge = true,
                  TokenValidationParameters = new TokenValidationParameters
                  {
                      ValidateIssuerSigningKey = true,
                      IssuerSigningKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes("supersecretkey")),
                      ValidateIssuer = false,
                      ValidateAudience = false,
                      ValidateLifetime = true,
                      ClockSkew = TimeSpan.Zero
                  }
              });
              app.UseMvc(routes =&gt; routes.MapRoute("default", "{controller=Home}/{action=Index}/{id?}"));
          }
      }
  }
  </code></pre>
  
  <p>Controllers/IconsController.cs</p>
  
  <pre><code>using Microsoft.AspNetCore.Authorization;
  using Microsoft.AspNetCore.Mvc;
  
  namespace JWTSecurity.Controllers
  {
      [Route("api/[controller]")]
      public class IconsController : Controller
      {
          [Authorize]
          public IActionResult Get()
          {
              return Ok("Some content");
          }
      }
  }
  </code></pre>