Open
Description
Describe the bug
When using AddIdentityServerJwt
the IssuerURL seems to be derived from the actual request. The option management hooks into the events and enriches the options with the host name from the request:
When the first request that comes in is not the public host name, the options is enriched with the wrong host and all subsequent calls to authorize fail because the issuer URL does not match.
Consider a scenario where you have a health check running. The health service uses the internal IP (e.g. in kubernetes) to call the health endpoint and the issuer URL is configured with the IP address.
To Reproduce
- Create a new SPA sample (dotnet new react -au Individual)
- Login
- Restart the server
- Go to https://127.0.0.1:5001 before you go to any other URL
- Go to https://localhost:5001 and press fetch data
The result in Chrome:
Bearer error="invalid_token", error_description="The issuer 'https://localhost:5001' is invalid"
Further technical details
- ASP.NET Core version 5