JWT Authentication Events Return Incorrect HTTP Status Codes

[tymur999]

The JwtBearerOptions.Events when .AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(...) is injected does not return the correct http status codes as specified. When adding these events to be called when the request is challenged or forbidden, the WriteAsJsonAsync method specifically describes that it will return a 200 HTTP status. This occurs normally with the OnChallenge handler, where a 200 is returned, but OnForbidden still returns a 403 even though the same method WriteAsJsonAsync says that it will return 200 HTTP status.

.AddJwtBearer(options =>
                {
                    options.Events = new JwtBearerEvents
                    {
                        OnChallenge = ctx =>
                            ctx.Response.WriteAsJsonAsync(<response object here>), //Returns 200, normal
                        OnForbidden = ctx =>
                            ctx.Response.WriteAsJsonAsync(<response object here>) //Returns 403, but supposed to be 200
                    };
                });

I know that 403 really means forbidden, and it says that is what is supposed to be returned for OnForbidden in MS Docs, but the WriteAsJsonAsync specifically says that

"the status code [will be] set to 200."

[tymur999]

Found a temporary solution

OnForbidden = ctx =>
{
     ctx.Response.StatusCode = 200;
     ctx.Response.WriteAsJsonAsync(<response object here>);
}

[Tratcher]

WriteAsJsonAsync originally set the status code to 200, but that changed to use the current value before 5.0 released. The docs didn't get updated until later (#27108).

The Challenge code path doesn't set the default 401 status code until after the event. By the way, you need to call ctx.Handled() on that event context to prevent errors later.

aspnetcore/src/Security/Authentication/JwtBearer/src/JwtBearerHandler.cs

Lines 218 to 224 in 891dd0f

	await Events.Challenge(eventContext);
	if (eventContext.Handled)
	{
	return;
	}
	Response.StatusCode = 401;

The Forbid code path sets the 403 before calling the event. Not sure why they're inconsistent.

aspnetcore/src/Security/Authentication/JwtBearer/src/JwtBearerHandler.cs

Lines 280 to 281 in 891dd0f

	Response.StatusCode = 403;
	return Events.Forbidden(forbiddenContext);

Your workaround is the correct approach.

This issue has been resolved and has not had any activity for 1 day. It will be closed for housekeeping purposes.

See our Issue Management Policies for more information.