I am developing an API in .NET 8 and implementing authentication using JWT with Microsoft.AspNetCore.Authentication.JwtBearer.

The problem is that when I send the token in the Authorization header as Bearer <TOKEN>, I get the following error:

Bearer error="invalid_token", error_description="The signature is invalid"

Additionally, the logs show:

Failed to validate the token. Microsoft.IdentityModel.Tokens.SecurityTokenInvalidSignatureException: IDX14100: JWT is not well formed, there are no dots (.).

JWT configuration in Program.cs:

var jwtSettings = builder.Configuration.GetSection("JwtSettings");
var secretKey = jwtSettings["SecretKey"];
var issuer = jwtSettings["Issuer"];
var audience = jwtSettings["Audience"];

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.RequireHttpsMetadata = false;
        options.SaveToken = true;
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidIssuer = issuer,
            ValidateAudience = true,
            ValidAudience = audience,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey)),
        };
    });
JWT Token Generation Code

public async Task<string> GenerateJwtToken(string email)
{
    var jwtSettings = _config.GetSection("JwtSettings");
    var secretKey = jwtSettings["SecretKey"];
    var issuer = jwtSettings["Issuer"];
    var audience = jwtSettings["Audience"];

    var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey));
    var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

    var claims = new[]
    {
        new Claim(ClaimTypes.Name, email),
    };

    var token = new JwtSecurityToken(
        issuer: issuer,
        audience: audience,
        claims: claims,
        expires: DateTime.UtcNow.AddHours(1),
        signingCredentials: credentials
    );

    return new JwtSecurityTokenHandler().WriteToken(token);
}

appsettings.json configuration

"JwtSettings": {
    "SecretKey": "SuperSecretKeyWithAtLeast32Characters1234567890",
    "Issuer": "OGAAuthServer",
    "Audience": "OGAClients"
}

What I have tried:

• Verifying the secret key: ensured that SecretKey is the same in both token generation and validation.
• Decoding the token using jwt.io: the token appears well-formed, but the validation still fails.
• Checking issuer and audience values: they match in both configurations.
• Testing different versions of Microsoft.IdentityModel.Tokens: tried 8.7.0 and 7.1.2, but the issue persists.
• Enabling detailed authentication logs: No additional useful information appears in the logs.

Questions

Why does the server keep rejecting the token with "The signature is invalid"?

Is there an incompatibility between .NET 8 and Microsoft.IdentityModel.Tokens?

How can I debug this issue further?

Thanks in advance for your help!

I am developing an API in .NET 8 and implementing authentication using JWT with Microsoft.AspNetCore.Authentication.JwtBearer.

The problem is that when I send the token in the Authorization header as Bearer <TOKEN>, I get the following error:

Bearer error="invalid_token", error_description="The signature is invalid"

Additionally, the logs show:

Failed to validate the token. Microsoft.IdentityModel.Tokens.SecurityTokenInvalidSignatureException: IDX14100: JWT is not well formed, there are no dots (.).

JWT configuration in Program.cs:

var jwtSettings = builder.Configuration.GetSection("JwtSettings");
var secretKey = jwtSettings["SecretKey"];
var issuer = jwtSettings["Issuer"];
var audience = jwtSettings["Audience"];

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.RequireHttpsMetadata = false;
        options.SaveToken = true;
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidIssuer = issuer,
            ValidateAudience = true,
            ValidAudience = audience,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey)),
        };
    });
JWT Token Generation Code

public async Task<string> GenerateJwtToken(string email)
{
    var jwtSettings = _config.GetSection("JwtSettings");
    var secretKey = jwtSettings["SecretKey"];
    var issuer = jwtSettings["Issuer"];
    var audience = jwtSettings["Audience"];

    var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey));
    var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

    var claims = new[]
    {
        new Claim(ClaimTypes.Name, email),
    };

    var token = new JwtSecurityToken(
        issuer: issuer,
        audience: audience,
        claims: claims,
        expires: DateTime.UtcNow.AddHours(1),
        signingCredentials: credentials
    );

    return new JwtSecurityTokenHandler().WriteToken(token);
}

appsettings.json configuration

"JwtSettings": {
    "SecretKey": "SuperSecretKeyWithAtLeast32Characters1234567890",
    "Issuer": "OGAAuthServer",
    "Audience": "OGAClients"
}

What I have tried:

• Verifying the secret key: ensured that SecretKey is the same in both token generation and validation.
• Decoding the token using jwt.io: the token appears well-formed, but the validation still fails.
• Checking issuer and audience values: they match in both configurations.
• Testing different versions of Microsoft.IdentityModel.Tokens: tried 8.7.0 and 7.1.2, but the issue persists.
• Enabling detailed authentication logs: No additional useful information appears in the logs.

Questions

Why does the server keep rejecting the token with "The signature is invalid"?

Is there an incompatibility between .NET 8 and Microsoft.IdentityModel.Tokens?

How can I debug this issue further?

Thanks in advance for your help!

• c#
• jwt
• asp-core-webapi
• -8.0
• asp-core-8

• 2 You should also translate the title into English .... – marc_s Commented Mar 30 at 20:53
• stackoverflow/questions/79478683/… may be worth a read. – mjwills Commented Mar 30 at 23:14

1 Answer 1

You are using JwtSecurityTokenHandler to generate the jwt token

return new JwtSecurityTokenHandler().WriteToken(token);

So you have to configure the authentication middleware use SecurityTokenValidator to validate the token

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.UseSecurityTokenValidators=true;
       ...........
    });

it now use JsonWebTokenHandler by default: