title: ASP.NET Core authenticating with Identity Server JWT and Auth Cookie
body: <p>I can't see the wood for the JWTs here.</p>
  <p><strong>Background:</strong></p>
  <p>I am writing an API service and am planning to front it with a React SPA. I want to secure the APIs using IdentityServer 4. User needs to provide username and password to access a handful of the APIs - GetOrderDetails etc...</p>
  <p><strong>Setup:</strong></p>
  <p>MyService.API Startup.cs (.net 5.0)</p>
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
      services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
          .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, options =&gt;
          {
              options.ExpireTimeSpan = TimeSpan.FromMinutes(30);
          });
  
      // Identity Server Configuration
      services.AddAuthentication()
          .AddIdentityServerAuthentication(&quot;Bearer&quot;, options =&gt;
          {
              options.ApiName = &quot;myservice.api&quot;;
              options.Authority = &quot;https://localhost:5011&quot;; // the address IDS is listening on
          });
  
      services.AddAuthorization(options =&gt;
      {
          options.AddPolicy(CookieAuthenticationDefaults.AuthenticationScheme, new AuthorizationPolicyBuilder()
              .RequireAuthenticatedUser()
              .AddAuthenticationSchemes(CookieAuthenticationDefaults.AuthenticationScheme)
              .Build());
  
          options.DefaultPolicy = new AuthorizationPolicyBuilder()
              .RequireAuthenticatedUser()
              .AddAuthenticationSchemes(&quot;Bearer&quot;)
              .Build();
      }); 
  }
  
  public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
  {
      app.UseAuthentication();
      app.UseCookiePolicy(new CookiePolicyOptions
      {
          MinimumSameSitePolicy = Microsoft.AspNetCore.Http.SameSiteMode.Strict
      });
      app.UseAuthorization(); 
  }
  </code></pre>
  <p>MyService.API.Controllers OrdersController.cs</p>
  <pre><code>[Authorize]
  public class MyServiceController : ControllerBase 
  {
  
      [HttpGet]
      [Route(&quot;orders/basicOrderDetails/orderId&quot;)]
      public async Task&lt;IActionResult&gt; GetBasicOrderDetails([FromRoute] int orderId)
      {
          // this method returns back the some simple information to show on the
          // login screen
          var basicOrderDetails = service.GetBasicOrderDetails(orderId);
          
          return Ok(basicOrderDetails);
      }
  
      [AllowAnonymous]
      [HttpPost]
      [Route(&quot;orders/authenticate&quot;)]
      public async Task&lt;IActionResult&gt; Authenticate(FromBody] AuthenticateOrderCredentials creds)
      {
          var authenticated = _authenticationManager.Authenticate(creds.Email, creds.Password);
          if(!authenticated)
          {
              return Unauthorized();
          }
          
          var claims = new List&lt;Claim&gt; { new Claim(ClaimTypes.Email, orderCredentials.UserEmail) };
          var claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
          
          var authProperties = new AuthenticationProperties
          {
              AllowRefresh = true,
              ExpiresUtc = DateTimeOffset.UtcNow.AddMinutes(10),
              IssuedUtc = DateTimeOffset.UtcNow,
          };
  
          await HttpContext.SignInAsync(
              CookieAuthenticationDefaults.AuthenticationScheme,
              new ClaimsPrincipal(claimsIdentity),
              authProperties);
  
          return Ok();
      }
      
      [Authorize(AuthenticationSchemes = CookieAuthenticationDefaults.AuthenticationScheme)]
      [HttpGet]
      [Route(&quot;orders/orderId&quot;)]
      public async Task&lt;IActionResult&gt; GetOrder(FromRoute] int orderId)
      {
          var orderDetails = service.GetOrderDetails(orderId);
  
          return Ok(orderDetails);
      }
  }
  </code></pre>
  <p><strong>Testing:</strong></p>
  <p>No JWT and no Auth Cookie: I cannot call any method - makes sense.</p>
  <p>JWT token and no Auth Cookie: I can call the <code>GetBasicOrderDetails</code> api method - makes sense.</p>
  <p>JWT Token and no Auth Cookie:  I can still call the <code>GetOrder</code> api method - doesn't make sense because I thought it checks <code>[Authorize(AuthenticationSchemes = CookieAuthenticationDefaults.AuthenticationScheme)]</code> - I would expect 401.</p>
  <p>JWT token and Auth Cookie (after calling Authenticate): I can call the <code>GetOrder</code> api method - is this because of JWT or Cookie?</p>
  <p>No JWT and Auth Cookie: I can call <code>GetOrder</code> api method - makes sense.</p>
  <p><strong>Question:</strong></p>
  <p>Have I overthunk this? Not sure I understand what I should be doing? My thinking is I need to secure <strong>all</strong> APIs with Identity Server <strong>and</strong> I need to additionally provide an Authentication Cookie in order to access the <code>GetOrder</code> api method - is my thinking correct? Is providing just the Authentication Cookie to <code>GetOrder</code> sufficient and so that method doesn't need to be protected by Identity Server? If so, why is <code>GetOrder</code> returning 200 with no Cookie and with both?</p>
  <p>Many thanks for any help.</p>