[{"data":1,"prerenderedAt":151},["ShallowReactive",2],{"/2026/01/29-jwt-is-not-well-formed-in-asp.net-web-api-jwtbearer-.net-8":3},{"id":4,"title":5,"body":6,"date":142,"description":49,"extension":143,"meta":144,"navigation":145,"path":146,"robots":147,"seo":148,"stem":149,"__hash__":150},"posts/2026/01/29 JWT-is-not-well-formed-in-ASP.NET-Web-API-JwtBearer-.NET-8.md","29 JWT Is Not Well Formed In ASPNET Web API JwtBearer NET 8",{"type":7,"value":8,"toc":139},"minimark",[9,18,25,28,31,33,36,50,52,55,63,65,80,82,85,93,95,98,106,116,118,121,129,131,134,136],[10,11,13],"post-title",{":date":12},"date",[14,15,17],"h1",{"id":16},"jwt-is-not-well-formed-in-aspnet-web-api-jwtbearer-net-8","JWT is not well formed in ASP.NET Web API JwtBearer .NET 8",[19,20,21],"notes",{},[22,23,24],"p",{},"This is a repost from my old blog. First posted in 9/25/2024.",[26,27],"br",{},[22,29,30],{},"It never caused a problem for me to implement JwtBearer token validator, but this time it is really take my time to troubleshoot what's going on. Long story short, there's a breaking change going to .NET 8 and on top of that, the default package version doesn't solve the issue.",[26,32],{},[22,34,35],{},"Here's how I implement my service:",[37,38,39],"code-block",{},[40,41,46],"pre",{"className":42,"code":44,"language":45},[43],"language-text","services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)\n    .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options => ...removed for brevity);\nservices.AddAuthorization();\n\n...\n\napp.UseAuthentication();\napp.UseAuthorization();\n","text",[47,48,44],"code",{"__ignoreMap":49},"",[26,51],{},[22,53,54],{},"But checking the bearer token, it was a completely valid token. I retrieved the token using a quick custom middleware.",[37,56,57],{},[40,58,61],{"className":59,"code":60,"language":45},[43],"app.Use(async (context, next) =>\n{\n    await next.Invoke();\n    Debug.WriteLine(context.Request.Headers.Authorization);\n});\n\napp.UseAuthentication();\n\n...\n",[47,62,60],{"__ignoreMap":49},[26,64],{},[22,66,67,68,79],{},"Then I validate the token in ",[69,70,73],"span",{"className":71},[72],"text-blue-600",[74,75,76],"a",{"href":76,"rel":77},"https://jwt.io",[78],"nofollow",".",[26,81],{},[22,83,84],{},"The error that I received contains:",[37,86,87],{},[40,88,91],{"className":89,"code":90,"language":45},[43],"IDX14100: JWT is not well formed, there are no dots (.). The token needs to be in JWS or JWE Compact Serialization Format.\n",[47,92,90],{"__ignoreMap":49},[26,94],{},[22,96,97],{},"On top of that, the browser response header has the following header:",[37,99,100],{},[40,101,104],{"className":102,"code":103,"language":45},[43],"WWW-Authenticate: Bearer error=\"invalid_token\"\n",[47,105,103],{"__ignoreMap":49},[22,107,108,109],{},"Searching online, the most helpful hint is probably this thread: ",[69,110,112],{"className":111},[72],[74,113,114],{"href":114,"rel":115},"https://github.com/dotnet/aspnetcore/issues/52075",[78],[26,117],{},[22,119,120],{},"There are some suggestions in there, but the one that finally solves my problem is the fact that the following package version doesn't work:",[37,122,123],{},[40,124,127],{"className":125,"code":126,"language":45},[43],"Microsoft.IdentityModel.Protocols.OpenIdConnect 7.1.2\n",[47,128,126],{"__ignoreMap":49},[26,130],{},[22,132,133],{},"It was a transitive package and I have to upgrade it by installing the latest version, as of this time 8.1.0.",[26,135],{},[22,137,138],{},"And that fixed my issue without any code change.",{"title":49,"searchDepth":140,"depth":140,"links":141},2,[],"2026-01-29T00:00:00.000Z","md",{},true,"/2026/01/29-jwt-is-not-well-formed-in-asp.net-web-api-jwtbearer-.net-8",null,{"title":5,"description":49},"2026/01/29 JWT-is-not-well-formed-in-ASP.NET-Web-API-JwtBearer-.NET-8","k8a6Ev_SLmszK9hTRvKIEWcgNtpJpWpE-8OUs32qs8c",1785167451678]