35

After updating the package Microsoft.AspNetCore.Authentication.JwtBearer from version 3.1.14 to 6.0.1, requests with authentication fail with 401 Unauthorized "invalid token".

What needs to be changed with the new package version?

1
  • Downgrading the Nuget package Microsoft.IdentityModel.Tokens 6.18.0 -> 6.10.0 has helped me with Method not found Microsoft.IdentityModel.Tokens.InternalValidators.ValidateLifetimeAndIssuerAfterSignatureNotValidatedJwt May 25, 2022 at 19:32

4 Answers 4

72

This seems to be a bug. Adding an event handler (JwtBearerEvents), the failure could be identified as a MissingMethodException:

Method not found: 'Void Microsoft.IdentityModel.Tokens.InternalValidators.ValidateLifetimeAndIssuerAfterSignatureNotValidatedJwt(Microsoft.IdentityModel.Tokens.SecurityToken, System.Nullable`1<System.DateTime>, System.Nullable`1<System.DateTime>, System.String, Microsoft.IdentityModel.Tokens.TokenValidationParameters, System.Text.StringBuilder)'.

with stack trace

at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters)
at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken)
at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.HandleAuthenticateAsync()",

Simply adding the current version of System.IdentityModel.Tokens.Jwt solved the problem.


Update: Please also note the comment by @Rubenisme below.

8
  • 13
    Thanks, your fix works, and was easy to search for, but you can also do something else. This issue is identified here: github.com/AzureAD/… and as ericbl states there, it can also be fixed by removing an explicit reference to Microsoft.IdentityModel.Tokens. I tested both fixes on my application.
    – Rubenisme
    Jan 13, 2022 at 15:23
  • 3
    I confirm that removing the explicit reference works and imho it is the best solution.
    – Vočko
    Jan 20, 2022 at 6:13
  • 2
    Both fixes work. However, if you're unable to remove explicit reference to Microsoft.IdentityModel.Tokens then adding explicit for System.IdentityModel.Tokens.Jwt will solve the issue. Guess those 2 override each other or something
    – Cubelaster
    Feb 10, 2022 at 12:13
  • 1
    @MattRuwe I can't remember which one exactly fired, but I just tapped into all possible events.
    – Mo B.
    Sep 28, 2022 at 19:22
  • 1
    @MattRuwe If you run the code in debug and have a console output, set the log level to debug and you'll see the missing method exception in there too. I find that easier than wiring up event handlers. Sep 29, 2022 at 10:36
9

Although I guess you found the right solution, but I thought my answer might be a help for some problems.

After spending a whole day investigating on the same problem and finding no solutions, I decided to upgrade these libraries to match same version: 6.16.0 (on Mar 23, 2022)

  • Microsoft.IdentityModel.JsonWebTokens
  • Microsoft.IdentityModel.Logging
  • Microsoft.IdentityModel.Protocols
  • Microsoft.IdentityModel.Protocols.OpenIdConnect
  • Microsoft.IdentityModel.Tokens

And the problem disappeared.

2
  • 2
    It worked for me, i had to update all this references to the same version, thanks
    – thepanch
    Apr 29, 2022 at 19:42
  • This worked for me too. For some strange reasons, the previously referred versions were not identical, and I had to force them as you suggested.
    – NinjaCross
    Dec 23, 2022 at 11:27
0

I had a same problem in a project that I upgraded it from .NetCore 2.2 to .Net 6.0. I also update all packages and so on...

In my case I remove below reference from my project and it works fine!

<PackageReference Include="Microsoft.IdentityModel.Tokens" Version="6.25.0" />

For more details read this from here (on GitHub).

0

For me the problem was slightly different but related so I'll add it here in case anyone gets here looking for a solution to Method not found: 'Microsoft.IdentityModel.Tokens.BaseConfiguration Microsoft.IdentityModel.Tokens.TokenValidationParameters.get_Configuration()

There seems to be a bug with Microsoft.Identity.Web 1.19.0. Downgrading to 1.18.0 fixed it for me.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.