title: Check IP with JWT Authorization in ASP.NET Core Web Api
body: <p>Is it possible to check the IP adress when using <code>System.IdentityModel.Tokens.Jwt</code> in an ASP.NET core Web Api application?</p>
  
  <p>I thought about adding a Claim containing the IP of the user that requested it and check it somehow for each request. Normally I would use <code>OnActionExecuting</code> in ASP.NET MVC.</p>
  
  <p>Is there a Middleware/Authorization based solution?</p>
  
  <p>I Create my Jwt Token Claims like this:</p>
  
  <pre><code>private IEnumerable&lt;Claim&gt; getStandardClaims(IdentityUser user)
  {
      var claims = new List&lt;Claim&gt;
      {
          new Claim(ClaimTypes.Name, user.UserName),
          new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
          new Claim(JwtRegisteredClaimNames.Sub, user.UserName),
          new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
          new Claim("ipaddress", HttpContext.Connection.RemoteIpAddress.ToString())
      };
  
      return claims;
  }
  </code></pre>
  
  <p>this is what the JWT Data look like:</p>
  
  <pre><code>{
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "username",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "5a6b3eb8-ed7f-48c6-b10c-a279ffd4f7c8",
    "sub": "username",
    "jti": "44c95b53-bfba-4f33-b4c3-834127605432",
    "ipaddress": "::1",
    "exp": 1542707081,
    "iss": "https://localhost:5001/",
    "aud": "https://localhost:5001/"
  }
  </code></pre>
  
  <p>Edit: Possible Solution for JWT Claims?
  Maybe I have to read the Claims like this (Test code, no null checks ect..):</p>
  
  <pre><code>var auth = HttpContext.Request.Headers.FirstOrDefault(x =&gt; x.Key == "Authorization");
  string token = auth.Value[0].Split(' ')[1];
  
  JwtTokenService&lt;RefreshToken, string&gt; jwtService = new JwtTokenService&lt;RefreshToken, string&gt;(null);
  var principal = jwtService.GetPrincipalFromExpiredToken(token, _config["Jwt:Key"]);
  
  Claim ipClaim = principal.FindFirst(claim =&gt; claim.Type == "ipaddress");
  </code></pre>
  
  <p>This is the GetPrincipalFromExpiredToken Method:</p>
  
  <pre><code>public ClaimsPrincipal GetPrincipalFromExpiredToken(string token, string securityKey)
  {
      var tokenValidationParameters = new TokenValidationParameters
      {
          ValidateAudience = false, 
          ValidateIssuer = false,
          ValidateIssuerSigningKey = true,
          IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(securityKey)),
          ValidateLifetime = false 
      };
  
      var tokenHandler = new JwtSecurityTokenHandler();
      SecurityToken securityToken;
      var principal = tokenHandler.ValidateToken(token, tokenValidationParameters, out securityToken);
      var jwtSecurityToken = securityToken as JwtSecurityToken;
      if (jwtSecurityToken == null || !jwtSecurityToken.Header.Alg.Equals(SecurityAlgorithms.HmacSha256, StringComparison.InvariantCultureIgnoreCase))
          throw new SecurityTokenException("Invalid token");
  
      return principal;
  }
  </code></pre>