title: JWT always return unauthorized 401 on .net core api
body: <p>I have implemented jwt to authorize web api in .net core 2.2.
  i am successfully getting token and pass it to header but always getting unauthorize error.</p>
  
  <p>I am a basic user, I send my credentials to the API for authenticating. In exchange, I receive a JWT token but I don't have any information about the user since only the server has the secret key that is able to decode the JWT token. So does the server need to send me for example the id of the user so that I could call my api user/id for retrieving information about the user authenticated?</p>
  
  <p>my code in startup.cs is below</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
          {
              services.AddCors();
              services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
              services.AddTransient&lt;IDbConnection&gt;(db =&gt; new 
           OracleConnection(Configuration.GetConnectionString("abc")));
  
              var appSettingsSection = Configuration.GetSection("AppSettings");
              services.Configure&lt;AppSettings&gt;(appSettingsSection);
              services.AddMvc().AddJsonOptions(opt =&gt;
              {
                  opt.SerializerSettings.ContractResolver = new DefaultContractResolver { NamingStrategy = new DefaultNamingStrategy() };
              });
              // configure jwt authentication
              var appSettings = appSettingsSection.Get&lt;AppSettings&gt;();
              var key = Encoding.ASCII.GetBytes(appSettings.Secret);
              services.AddAuthentication(x =&gt;
              {
                  x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                  x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
              })
              .AddJwtBearer(x =&gt;
              {
                  x.RequireHttpsMetadata = false;
                  x.SaveToken = true;
                  x.TokenValidationParameters = new TokenValidationParameters
                  {
                      ValidateIssuerSigningKey = true,
                      IssuerSigningKey = new SymmetricSecurityKey(key),
                      ValidateIssuer = false,
                      ValidateAudience = false
                  };
              });
          }
  
  public void Configure(IApplicationBuilder app, IHostingEnvironment env)
          {
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
              }
              else
              {
                  app.UseExceptionHandler("/Home/Error");
                  app.UseHsts();
              }
  
              app.UseHttpsRedirection();
              app.UseStaticFiles();
              app.UseCookiePolicy();
  
              app.UseMvc(routes =&gt;
              {
                  routes.MapRoute(
                      name: "default",
                      template: "{controller=Home}/{action=Index}/{id?}");
              });
  
              app.UseExceptionHandler(appBuilder =&gt;
              {
                  appBuilder.Use(async (context, next) =&gt;
                  {
                      var error = context.Features[typeof(IExceptionHandlerFeature)] as IExceptionHandlerFeature;
  
                      if (error != null &amp;&amp; error.Error is SecurityTokenExpiredException)
                      {
                          context.Response.StatusCode = 401;
                          context.Response.ContentType = "application/json";
  
                          await context.Response.WriteAsync(JsonConvert.SerializeObject(new
                          {
                              State = "Unauthorized",
                              Msg = "token expired"
                          }));
                      }
  
                      else if (error != null &amp;&amp; error.Error != null)
                      {
                          context.Response.StatusCode = 500;
                          context.Response.ContentType = "application/json";
                          await context.Response.WriteAsync(JsonConvert.SerializeObject(new
                          {
                              State = "Internal Server Error",
                              Msg = error.Error.Message
                          }));
                      }
                      //when no error, do next.
                      else await next();
                  });
              });
  
  
              app.UseAuthentication();
  
              app.UseMvc();
          }
  </code></pre>