title: UseJwtBearerAuthentication returns 401
body: <p>I'm using Firebase and dotnet core in my application stack.</p>
  
  <p>I'm generating a JWT fine using the Firebase iOS API and can confirm that the structure is as expected and valid using <a href="http://jwt.io/" rel="nofollow noreferrer">jwt.io</a>'s parser.</p>
  
  <h3>The Setup</h3>
  
  <p>I've followed <a href="https://blog.markvincze.com/secure-an-asp-net-core-api-with-firebase/" rel="nofollow noreferrer">this article</a> to setup dotnet core to automatically set principal based on the request.</p>
  
  <p>The configure method of my Startup file looks like this, where in practice the <code>&lt;project-id&gt;</code> part is replaced by the project app (which I can confirm is the same as the <code>aud</code> property in my parsed JWT as seen on jwt.io):</p>
  
  <pre><code>public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
  {
      loggerFactory.AddConsole(Configuration.GetSection("Logging"));
      loggerFactory.AddDebug();
      loggerFactory.AddSerilog();
  
      app.UseJwtBearerAuthentication(new JwtBearerOptions
      {
          AutomaticAuthenticate = true,
          IncludeErrorDetails = true,
          Authority = "https://securetoken.google.com/&lt;project-id&gt;",
          TokenValidationParameters = new TokenValidationParameters
          {  
              ValidateIssuer = true,
              ValidIssuer = "https://securetoken.google.com/&lt;project-id&gt;",
              ValidateAudience = true,
              ValidAudience = "&lt;project-id&gt;",
              ValidateLifetime = true,
          },
      });
  
      app.UseMvc();
  }
  </code></pre>
  
  <h3>The Request</h3>
  
  <p>I have a controller action that I can hit at the url <code>http://localhost:5000/api/dashboard</code> and get the expected response when I don't have the <code>Authorize</code> attribute on the controller. I have then added the <code>Authorize</code> attribute back so I can start testing the JWT middleware.</p>
  
  <p>I'm creating a request in Postman as seen in this picture:
  <a href="https://i.stack.imgur.com/Abm1I.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Abm1I.png" alt="enter image description here"></a></p>
  
  <h3>The Response</h3>
  
  <p>As you can see in the picture above the response is a <code>401 Unauthorized</code>.</p>
  
  <p>The server logs in my debug output look like this.</p>
  
  <pre><code>info: Microsoft.AspNetCore.Hosting.Internal.WebHost[1]
        Request starting HTTP/1.1 GET http://localhost:5000/api/dashboard  
  Microsoft.AspNetCore.Hosting.Internal.WebHost:Information: Request starting HTTP/1.1 GET http://localhost:5000/api/dashboard  
  info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[2]
        Authorization failed for user: (null).
  Microsoft.AspNetCore.Authorization.DefaultAuthorizationService:Information: Authorization failed for user: (null).
  info: Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker[1]
        Authorization failed for the request at filter 'Microsoft.AspNetCore.Mvc.Authorization.AuthorizeFilter'.
  Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker:Information: Authorization failed for the request at filter 'Microsoft.AspNetCore.Mvc.Authorization.AuthorizeFilter'.
  info: Microsoft.AspNetCore.Mvc.ChallengeResult[1]
        Executing ChallengeResult with authentication schemes ().
  Microsoft.AspNetCore.Mvc.ChallengeResult:Information: Executing ChallengeResult with authentication schemes ().
  info: Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerMiddleware[12]
        AuthenticationScheme: Bearer was challenged.
  Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerMiddleware:Information: AuthenticationScheme: Bearer was challenged.
  info: Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker[2]
        Executed action Sured.Api.Controllers.DashboardController.Get (Sured.Api) in 20.2369ms
  Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker:Information: Executed action Sured.Api.Controllers.DashboardController.Get (Sured.Api) in 20.2369ms
  info: Microsoft.AspNetCore.Hosting.Internal.WebHost[2]
        Request finished in 37.6488ms 401 
  </code></pre>
  
  <h2>The Question</h2>
  
  <p>I've been researching on Google and trawling through source code and I simply can't crack this.</p>
  
  <p>Can anyone see what I am doing wrong here?</p>
  
  <p>For good measure, here's all the dependency versions in my project:</p>
  
  <pre><code>&lt;PackageReference Include="Microsoft.AspNetCore" Version="1.1.2" /&gt;
  &lt;PackageReference Include="Microsoft.AspNetCore.Mvc" Version="1.1.3" /&gt;
  &lt;PackageReference Include="Microsoft.Extensions.Logging.Debug" Version="1.1.2" /&gt;
  &lt;PackageReference Include="Serilog" Version="2.5.0" /&gt;
  &lt;PackageReference Include="Serilog.Enrichers.Environment" Version="2.1.2" /&gt;
  &lt;PackageReference Include="Serilog.Extensions.Logging" Version="1.4.0" /&gt;
  &lt;PackageReference Include="Serilog.Settings.Configuration" Version="2.4.0" /&gt;
  &lt;PackageReference Include="Serilog.Sinks.ElasticSearch" Version="5.3.0" /&gt;
  &lt;PackageReference Include="Serilog.Sinks.RollingFile" Version="3.3.0" /&gt;
  &lt;PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="1.1.2" /&gt;
  </code></pre>