From URL JWT token authentication & manually authorizing HttpContext in .Net core MVC
Tags: security, webdev, dotnet, jwt
Published: 2019-04-05 12:01:02

---
title: From URL JWT token authentication & manually authorizing HttpContext in .Net core MVC
published: true
description: Authenticating user with in URL JWT 
tags: security , webdev ,dotnet,jwt
cover_image: https://cdn-images-1.medium.com/max/800/0*lPmgC72P7_Jy7r-p
---
In a normal authentication with JWT the token will be in the “Auth header” of the request and the authentication will take place as explained [here](https://code-maze.com/authentication-aspnetcore-jwt-1/)

<blockquote class="embedly-card"><h4><a href="https://code-maze.com/authentication-aspnetcore-jwt-1/">ASP.NET Core Authentication with JWT and Angular - Part 1</a></h4><p>Securing a web application is one of the most important to do and usually one of the hardest things to pull off. In this series, we are going tolearn how to implement authentication with Angular on the front end side and ASP.Net Core on the server side using the JSON web tokens (JWT).</p></blockquote>

But in case you need to authorize your requests with JWT token while the token is in the URL like this:

```
https://localhost:444/controller/action?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dzLzIwMDgvMDYvaWRlbnRpdHkvY2xhaW1zL3VzZXJkYXRhIjoie1widXNlcm5hbWVcIjpcInRlYWNoZXJAa28uY29tXCIsXCJwZWVyVXNlck5hbWVcIjpcInN0dWRlbnRAa28uY29tXCIsXCJwbGF0Zm9ybUlkXCI6MCxcInRlbmFudElkXCI6XCI4M0IwM0RCQi0xQTEyLTQwQ0YtQjZDRS0wNDQ2RTA5RDFBNjcjZGV2b3AuYWxpQGdtYWlsLmNvbVwiLFwicGVlckRpc3BsYXlOYW1lXCI6XCJUZWFjaGVyIDFcIixcImRpc3BsYXlOYW1lXCI6XCJzdHVkZW50IDFcIixcInJ0Y1VybFwiOlwiaHR0cHM6Ly9sb2NhbGhvc3Q6NDQ0L3dlYnJ0Yy9jYWxsXCIsXCJzZXJ2aWNlVXJsXCI6XCJodHRwczovL1NlcnZpY2UvTG9nL2xvZ1wifSIsImV4cCI6MTU0NzgxNzcxMiwiaXNzIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6NDQ0IiwiYXVkIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6NDQ0In0.
DUzq0Im1nXLdGtZVI389NhuMXDe0YkGpZJTvOHytOoQ
```

things will get a bit tricky. so I decided to make a quick tutorial to explain how I managed to implement it.

## In a Nutshell
![](https://cdn-images-1.medium.com/max/800/1*AXjtDc1ZJXfQcUArMlwx5A.png)

so let’s get to it :) your **ConfigureServices** method will be something like this :

```c#
services.Configure<CookiePolicyOptions>(options =>
{
    options.CheckConsentNeeded = context => true;
    options.MinimumSameSitePolicy = SameSiteMode.None;
});

services.AddMvc()
    .SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
```
and your **Configure** method:

```c#
if (env.IsDevelopment())
{
    app.UseDeveloperExceptionPage();
}
else
{
    app.UseExceptionHandler("/Home/Error");
    app.UseHsts();
    app.UseHttpsRedirection();
}

app.UseStaticFiles();
app.UseCookiePolicy();
app.UseMiddleware(typeof(AuthorizationMiddleware));
app.UseMvc(routes =>
{
    routes.MapRoute(
        name: "default",
        template: "{controller=Home}/{action=Index}/{id?}");
});
```

the magic will happen in
```c#
app.UseMiddleware(typeof(AuthorizationMiddleware));
```

Let’s have look at **AuthorizationMiddleware**’s invoke method in detail:

```c#
public async Task InvokeAsync(HttpContext context)
{
    //getting the token from the URL
    var queryString = HttpUtility.ParseQueryString(context.Request.QueryString.Value);

    //setting the validation parameters
    //warning : these parameters should be same with the token's issuer parameters 
    var validationParameters = new TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidateLifetime = true,
        ValidateIssuerSigningKey = true,

        ValidIssuer = _settings.Value.Jwt_valid_issuer,
        ValidAudience = _settings.Value.Jwt_valid_audience,
        IssuerSigningKey =
            new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_settings.Value.Jwt_issuer_key))
    };

    var validator = new JwtSecurityTokenHandler();

    if (!validator.CanReadToken(queryString.Get("token")))
        throw new UnauthorizedAccessException("token is not readable");
    try
    {
        //trying to parse the token 
        var principal =
            validator.ValidateToken(queryString.Get("token"), validationParameters, out var validatedToken);
        if (principal.HasClaim(c => c.Type == ClaimTypes.UserData))
        {
            var userData = principal.Claims.First(c => c.Type == ClaimTypes.UserData).Value;

            //setting AuthData to be used for later usages in other middlewares
            //as well as the controller which is in the MVC middleware 
            context.Items["AuthData"] = JsonConvert.DeserializeObject<LoginModel>(userData);

            //authorizing the http context 
            context.User.AddIdentity((ClaimsIdentity) principal.Identity);
            
            //invoking the next middleware 
            await _next.Invoke(context);
        }
    }
    catch (Exception e)
    {
        throw;
    }
}
```
therefore if this Middleware reaches the

```c#
await _next.Invoke(context);
```
it means that the token is valid and the HttpContext is authorized plus we have added the parsed version of the token to the HttpContext

```c#
context.Items["AuthData"] = JsonConvert.DeserializeObject<LoginModel>(userData);
```

So you can implement your controller like you have used the default JwtBearer authentication:

```c#
[HttpGet,Authorize]
public IActionResult Action()
{
    //retrieve the parsed token 
    var loginModel = HttpContext.Items["AuthData"] as LoginModel;
    return View(loginModel?.Username);
}
```
Let me know if you had any questions & have fun coding :)