79311213

Date: 2024-12-27 07:48:15
Score: 2
Natty:
Report link

Now I have this side of the logic figured out. But thing is for some reason. This structure completely ignores the Bearer Token.

You are correct. Please take a look at this https://github.com/dotnet/aspnetcore/blob/main/src/Security/Authentication/JwtBearer/src/JwtBearerHandler.cs#L74, it is the reason. I believe you can understand why it ignore Bearer Token in Authorization Header: the logic for loading token is skipped because you set token at OnMessageReceived event.

Btw, I see your design is a little bit weird, why you set Refresh Token to auth_token cookie, and OnMessageReceived set token from auth_token as refresh token to authenticate (instead of access token). Please clarify your purpose first.

Reasons:
  • RegEx Blacklisted phrase (2.5): Please clarify your
  • Long answer (-0.5):
  • Has code block (-0.5):
  • Low reputation (0.5):
Posted by: Nguyễn Kỳ Dương Trường