All 15 Authentication questions
More in Authentication
How does two-factor authentication (2FA) work with ASP.NET Core Identity, and what does the sign-in flow look like? What is the purpose of the authentication middleware's position in the pipeline, and why must UseAuthentication come before UseAuthorization? How do claims transformations (IClaimsTransformation) let you augment a user's claims after initial authentication but before authorization checks run? What is the difference between IAuthenticationService's SignInAsync/SignOutAsync methods and simply checking if a user 'is authenticated'? How do external identity provider integrations (like Google or Microsoft Entra ID) work using OAuth/OpenID Connect authentication handlers? How do refresh tokens work alongside short-lived JWT access tokens, and how would you implement a refresh endpoint? How do you implement API key authentication as a custom authentication scheme for machine-to-machine API access? How would you implement sign-out that properly invalidates both a cookie session and any associated server-side state? How does Windows Authentication (Negotiate/Kerberos) work in ASP.NET Core for intranet applications, and when is it appropriate? How would you implement passwordless authentication (like a magic link sent via email) in ASP.NET Core?
Advertisement
ASP.NET Core › Authentication

How does JWT bearer authentication validate an incoming token, and what claims does TokenValidationParameters check?

Advanced

Answer

The JWT bearer handler extracts the token from the Authorization: Bearer header, verifies its cryptographic signature against the configured signing key, and validates standard claims per TokenValidationParameters -- expiration (exp), not-before (nbf), issuer (iss must match ValidIssuer), and audience (aud must match ValidAudience) -- rejecting the request with 401 if any check fails, all before the request reaches your endpoint code.
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options => {
        options.TokenValidationParameters = new TokenValidationParameters {
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = new SymmetricSecurityKey(key),
            ValidateIssuer = true, ValidIssuer = "myapp",
            ValidateAudience = true, ValidAudience = "myapp-api",
            ValidateLifetime = true
        };
    });
Real-world example A stateless microservices API validates every incoming JWT's signature and claims on each request without any server-side session lookup, letting it scale horizontally without shared session state.

Common follow-ups: How do you fetch signing keys dynamically from an identity provider's JWKS endpoint instead of hardcoding them?;What happens if ClockSkew isn't configured for distributed systems with slightly different clocks?

Authorization;Configuration & Options Pattern
All 15 Authentication questions