title: ASP Web API custom authentication. Always getting a 401 Unauthorized response
body: <p>I am trying to implement an authentication/authorization process which when user signs in, generates a JWT and places it in a cookie (while implementing I was mainly using this article - thought it's for .NET Core and I am using .NET 4.6: <a href="https://stormpath.com/blog/token-authentication-asp-net-core" rel="nofollow noreferrer">https://stormpath.com/blog/token-authentication-asp-net-core</a> ). So far, this process works ok, but when I try to make a request to a secured endpoint (decorated with an [Authorize] attribute) with the JWT in the cookie, I always get a 401 Unauthorized response. Even though the JWT seams to get validated and an AuthenticationTicket is being returned from the Unprotect method of the CustomJwtDataFormat class.</p>
  
  <p>As recommended in the answer to this question <a href="https://stackoverflow.com/questions/20254796/why-is-my-claimsidentity-isauthenticated-always-false-for-web-api-authorize-fil?noredirect=1&amp;lq=1">Why is my ClaimsIdentity IsAuthenticated always false (for web api Authorize filter)?</a>
  I added the AuthenticationType parameter while creating the ClaimsIdentity. But still the same 401 response.</p>
  
  <p>Here is my ConfigureAuth method:</p>
  
  <pre class="lang-cs prettyprint-override"><code>public void ConfigureAuth(IAppBuilder app)
          {
              app.UseCookieAuthentication(new CookieAuthenticationOptions
              {
                  Provider = new CookieAuthenticationProvider(),
  
                  CookieName = "access_token",
                  AuthenticationMode = 
                  Microsoft.Owin.Security.AuthenticationMode.Active,
                  AuthenticationType = AuthenticationTypes.Password,
                  TicketDataFormat = new CustomJwtDataFormat(
                  SecurityAlgorithms.HmacSha256,
                  SettingsConfig.TokenValidationParameters)
              });
           }
  </code></pre>
  
  <p>The Unprotect method of the CustomJwtDataFormat class:</p>
  
  <pre class="lang-cs prettyprint-override"><code>        public AuthenticationTicket Unprotect(string protectedText)
          {
              var handler = new JwtSecurityTokenHandler();
              ClaimsPrincipal principal = null;
              SecurityToken validToken = null;
  
              try
              {
                  principal = handler.ValidateToken(protectedText, this.validationParameters, out validToken);
  
                  var validJwt = validToken as JwtSecurityToken;
  
                  if (validJwt == null)
                  {
                      throw new ArgumentException("Invalid JWT");
                  }
  
                  if (!validJwt.Header.Alg.Equals(algorithm, StringComparison.Ordinal))
                  {
                      throw new ArgumentException($"Algorithm must be '{algorithm}'");
                  }
  
              }
              catch (SecurityTokenValidationException e)
              {
                  var ex = e;
                  return null;
              }
              catch (ArgumentException e)
              {
                  var ex = e;
                  return null;
              }
              var identity = new ClaimsIdentity(principal.Identities.FirstOrDefault().Claims, AuthenticationTypes.Password);
  
              // Validation passed. Return a valid AuthenticationTicket:
              var authTicket = new AuthenticationTicket(identity, new AuthenticationProperties());
  
              return authTicket;
  </code></pre>
  
  <p>My TokenValidationParameters:</p>
  
  <pre class="lang-cs prettyprint-override"><code> public static TokenValidationParameters TokenValidationParameters = new TokenValidationParameters
          {
              // The signing key must match!
              ValidateIssuerSigningKey = true,
              IssuerSigningKey = signingKey,
  
              // Validate the JWT Issuer (iss) claim
              ValidateIssuer = true,
              ValidIssuer = "ExampleIssuer",
  
              // Validate the JWT Audience (aud) claim
              ValidateAudience = true, 
              ValidAudience = "ExampleAudience",
  
              // Validate the token expiry
              ValidateLifetime = true,
  
              ClockSkew = TimeSpan.FromMinutes(5)
          };
  </code></pre>
  
  <p>The GenerateToken method:</p>
  
  <pre class="lang-cs prettyprint-override"><code>        public static string GenerateToken(MetadataForToken tokenContentAndMetadata)
          {
              var symmetricKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(tokenContentAndMetadata.SecretKey));
  
  
              var tokenHandler = new JwtSecurityTokenHandler();
              var now = DateTime.UtcNow;
  
              var tokenDescriptor = new SecurityTokenDescriptor
              {
                  Subject = new ClaimsIdentity(tokenContentAndMetadata.Claims),
                  Expires = now.AddMinutes(Convert.ToInt32(tokenContentAndMetadata.ExpireMinutes)),
                  SigningCredentials = new SigningCredentials(symmetricKey, tokenContentAndMetadata.SecurityAlgorithm),
                  Issuer = "ExampleIssuer",
                  Audience = "ExampleAudience"
              };
              var sToken = tokenHandler.CreateToken(tokenDescriptor);
              var token = tokenHandler.WriteToken(sToken);
  
              return token;
          }
  </code></pre>
  
  <p>What am I doing wrong?</p>