AuthAction.AspNetCore 0.1.1

AuthAction.AspNetCore

ASP.NET Core JWT authentication middleware for AuthAction. One call to AddAuthAction() configures JWT Bearer authentication, JWKS key fetching and caching, audience validation, and the [CurrentUser] parameter attribute.

Prerequisites

• .NET 8+
• An AuthAction tenant with an API registered

Installation

dotnet add package AuthAction.AspNetCore

Quick start

1. Add credentials to appsettings.json:

{
  "AuthAction": {
    "Domain": "myapp.eu.authaction.com",
    "Audience": "https://api.myapp.com"
  }
}

2. Register the middleware in Program.cs:

using AuthAction.AspNetCore;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthAction(options =>
    builder.Configuration.GetSection("AuthAction").Bind(options));

builder.Services.AddAuthorization();
builder.Services.AddControllers();

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();

app.Run();

3. Protect routes and inject the current user:

using AuthAction.AspNetCore;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

[ApiController]
[Route("[controller]")]
public class ProfileController : ControllerBase
{
    [HttpGet]
    [Authorize]
    public IActionResult Get([CurrentUser] UserInfo user) =>
        Ok(new { user.Sub, user.Email });
}

Configuration

You can also configure via environment variables using ASP.NET Core's double-underscore convention:

export AUTHACTION__DOMAIN=myapp.eu.authaction.com
export AUTHACTION__AUDIENCE=https://api.myapp.com

[CurrentUser] attribute

Add [CurrentUser] UserInfo user to any [Authorize]-protected action parameter to receive a typed object populated from the verified JWT claims.

[HttpGet("/me")]
[Authorize]
public IActionResult Me([CurrentUser] UserInfo user) =>
    Ok(new
    {
        user.Sub,
        user.Email,
        user.EmailVerified,
        user.Name,
        user.Picture,
    });

UserInfo exposes the standard OIDC claims plus a Claims dictionary for any custom claims:

How it works

AddAuthAction() calls AddJwtBearer() with Authority set to https://<domain>. ASP.NET Core's built-in JWT Bearer middleware:

1. Fetches https://<domain>/.well-known/openid-configuration to discover the JWKS URI.
2. Downloads and caches the public keys from the JWKS endpoint.
3. Validates RS256 signature, issuer, audience, and token expiry on every request.
4. Re-fetches keys automatically when an unknown kid is encountered (key rotation).

No manual JWKS handling or caching is required.

Running the tests

dotnet test

The test suite uses WebApplicationFactory with a fake authentication handler — no real JWKS calls are made.

Example app

See authaction-dotnet-example for a full ASP.NET Core Web API example.

License

MIT