# Dotnet core OKTA not accepting Authorization header token from React

**URL:** <https://devforum.okta.com/t/dotnet-core-okta-not-accepting-authorization-header-token-from-react/11366>\
**Category:** Questions\
**Tags:** dotnet, react\
**Created:** [October 15, 2020, 12:13pm UTC](https://devforum.okta.com/t/dotnet-core-okta-not-accepting-authorization-header-token-from-react/11366 "2020-10-15T12:13:59Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![clawlor](https://avatars.discourse-cdn.com/v4/letter/c/b77776/32.png) [@clawlor](https://devforum.okta.com/u/clawlor)\
**Post date:** [October 15, 2020, 12:13pm UTC](https://devforum.okta.com/t/dotnet-core-okta-not-accepting-authorization-header-token-from-react/11366/1 "2020-10-15T12:13:59Z")

</div>

Hi Guys & Girls,

I recently created a React Frontend with OKTA auth that works fine. I’ve added my token to the Authorization header to be sent to my Dotnet core backend( as per the Okta tutorial: [https://developer.okta.com/docs/guides/sign-into-spa/react/use-the-access-token/](https://developer.okta.com/docs/guides/sign-into-spa/react/use-the-access-token/)).

The problem is, when the request with header is sent, it causes this error:

System.InvalidOperationException: IDX20803: Unable to obtain configuration from: ‘System.String’.  
at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.GetConfigurationAsync(CancellationToken cancel) at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.HandleAuthenticateAsync() at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.HandleAuthenticateAsync() at Microsoft.AspNetCore.Authentication.AuthenticationHandler`1.AuthenticateAsync()  
at Microsoft.AspNetCore.Authentication.AuthenticationService.AuthenticateAsync(HttpContext context, String scheme)  
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)  
at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

# HEADERS

Accept: application/json, text/plain, _/_  
Accept-Encoding: gzip, deflate, br  
Accept-Language: en-US,en;q=0.9  
Authorization: Bearer (AUTH TOKEN HERE)  
Cache-Control: no-cache  
Connection: close  
Host: localhost:44300  
Pragma: no-cache  
Referer: [http://localhost:44350/](http://localhost:44350/)  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36  
origin: [http://localhost:44350](http://localhost:44350)  
sec-fetch-site: cross-site  
sec-fetch-mode: cors  
sec-fetch-dest: empty

I am setting my dotnet core backend up as specified in Okta tutorial: [https://developer.okta.com/docs/guides/protect-your-api/aspnetcore3/configure-packages/](https://developer.okta.com/docs/guides/protect-your-api/aspnetcore3/configure-packages/)

Issuer is the same on both back and frontend… issuer: ‘[https://xxx.oktapreview.com](https://xxx.oktapreview.com)’,

Would anyone know what is causing this? It doesn’t seem to like any token, especially any with ‘bearer’ prefixing it, but that’s what the tutorial says…

---

<div class="post-metadata">

**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\
**Post date:** [October 16, 2020, 3:10pm UTC](https://devforum.okta.com/t/dotnet-core-okta-not-accepting-authorization-header-token-from-react/11366/2 "2020-10-16T15:10:20Z")

</div>

How exactly did you configure your backend middleware and initialize your backend during startup? It seems to me that your backend app fails to pull OIDC meta configuration from Okta.

---

<div class="post-metadata">

**Author:** ![clawlor](https://avatars.discourse-cdn.com/v4/letter/c/b77776/32.png) [@clawlor](https://devforum.okta.com/u/clawlor)\
**Post date:** [October 16, 2020, 4:06pm UTC](https://devforum.okta.com/t/dotnet-core-okta-not-accepting-authorization-header-token-from-react/11366/3 "2020-10-16T16:06:36Z")

</div>

same as outlined here:

> **[Add and configure packages | Okta Developer](https://developer.okta.com/docs/guides/protect-your-api/aspnet/configure-packages/)**

```
    public virtual void ConfigureServices(IServiceCollection services)
    {
        //OKTA authentication
        services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = OktaDefaults.ApiAuthenticationScheme;
            options.DefaultChallengeScheme = OktaDefaults.ApiAuthenticationScheme;
            options.DefaultSignInScheme = OktaDefaults.ApiAuthenticationScheme;
        })
    
                .AddOktaWebApi(new OktaWebApiOptions()
                {
                    OktaDomain = this.configuration.GetValue<string>("OktaAuth:Authority")
                }
           

             );

        // All other services
        services
            .AddCustomCaching()
            .AddCustomCors()
            .AddCustomOptions(this.configuration)
            .AddCustomRouting()
            .AddResponseCaching()
            .AddCustomStrictTransportSecurity()
            .AddCustomHealthChecks()
            .AddCustomSwagger()
            .AddServerTiming()
            .AddAuthorization()
            .AddControllers()
            .Services
            .AddProjectMappers()
            .AddProjectRepositories()
            .AddProjectServices();

    public virtual void Configure(IApplicationBuilder application) => application
            .UseStaticFiles()
            .UseCookiePolicy()
            .UseIf(
                this.webHostEnvironment.IsDevelopment(),
                x => x.UseServerTiming())
                .UseResponseCaching()
                .UseIf(
                !this.webHostEnvironment.IsDevelopment(),
                x => x.UseHsts())
                .UseIf(
                this.webHostEnvironment.IsDevelopment(),
                x => x.UseDeveloperExceptionPage())
            .UseRouting()
            .UseCors(options => options.AllowAnyOrigin())
            .UseAuthentication()
            .UseAuthorization()
            .UseCustomSerilogRequestLogging()
            .UseEndpoints(
                builder =>
                {
                    builder.MapControllers().RequireCors(CorsPolicyName.AllowAny);
                    builder.MapDefaultControllerRoute();
                    builder
                    .MapHealthChecks("/status")
                    .RequireCors(CorsPolicyName.AllowAny);
                    builder
                        .MapHealthChecks("/status/self", new HealthCheckOptions() { Predicate = _ => false })
                        .RequireCors(CorsPolicyName.AllowAny);
                })
            .UseSwagger()
            .UseCustomSwaggerUI();
}

```

}

---

<div class="post-metadata">

**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\
**Post date:** [October 16, 2020, 8:02pm UTC](https://devforum.okta.com/t/dotnet-core-okta-not-accepting-authorization-header-token-from-react/11366/4 "2020-10-16T20:02:29Z")

</div>

> [@clawlor](#):
>
> `OktaDomain = this.configuration.GetValue<string>("OktaAuth:Authority")`

what’s the value for this config param? as I believe it participates in forming the URL to get the metadata from

---

<div class="post-metadata">

**Author:** ![clawlor](https://avatars.discourse-cdn.com/v4/letter/c/b77776/32.png) [@clawlor](https://devforum.okta.com/u/clawlor)\
**Post date:** [October 19, 2020, 9:30am UTC](https://devforum.okta.com/t/dotnet-core-okta-not-accepting-authorization-header-token-from-react/11366/5 "2020-10-19T09:30:50Z")

</div>

OK i figured it out based on you telling me to look more closely at the Authority provider :). I simply had:  
“Authority”: “[https://xxx.oktapreview.com/oauth/default](https://xxx.oktapreview.com/oauth/default)” instead of:  
“Authority”: “[https://xxx.oktapreview.com](https://xxx.oktapreview.com)”. I think I just followed some bad advice on stack overflow for this one.  
Thank you so much for help 🙂

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [September 3, 2021, 4:32pm UTC](https://devforum.okta.com/t/dotnet-core-okta-not-accepting-authorization-header-token-from-react/11366/6 "2021-09-03T16:32:37Z")

</div>

Closed on September 3, 2021, 4:32pm UTC

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.