# Verify access token in ASP.Net Core 2.0 backend forwarded from Angular 4 SPA - OpenIDC

**URL:** <https://devforum.okta.com/t/verify-access-token-in-asp-net-core-2-0-backend-forwarded-from-angular-4-spa-openidc/1221>\
**Category:** OAuth/OIDC\
**Tags:** dotnet\
**Created:** [February 12, 2018, 8:41am UTC](https://devforum.okta.com/t/verify-access-token-in-asp-net-core-2-0-backend-forwarded-from-angular-4-spa-openidc/1221 "2018-02-12T08:41:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bitibi](https://avatars.discourse-cdn.com/v4/letter/b/c89c15/32.png) [@bitibi](https://devforum.okta.com/u/bitibi)\
**Post date:** [February 12, 2018, 8:41am UTC](https://devforum.okta.com/t/verify-access-token-in-asp-net-core-2-0-backend-forwarded-from-angular-4-spa-openidc/1221/1 "2018-02-12T08:41:46Z")

</div>

Hi Okta developers,

I’m trying to build a sample app + backend as a proof of concept before I start to build a complex system using these technologies. I have an Angular 4 SPA, and a working Okta login based on this post:  
[https://developer.okta.com/blog/2017/04/17/angular-authentication-with-oidc](https://developer.okta.com/blog/2017/04/17/angular-authentication-with-oidc)

I also have a .Net core 2.0 API, providing data to the frontend. I would like to forward the access token from Angular and verify it in the API. I tried this:

When making request to the API, I get the token from the OAuthService:

> ```
> getAllArticles(){
> return this.http
> .get<Article[]>(this._theUrl,{
> headers: new HttpHeaders({
> 'Content-Type': 'application/json',
> 'Authorization': 'Bearer '+this.oAuthService.getAccessToken()
> }),
> observe: "body",
> responseType: "json"
> });
> }
> 
> ```

I can see the token in the API in HttpContext, so it is coming through.

Then I tried to turn on Authentication in .Net Core in startup.cs → ConfigureServices:

```
        services.AddAuthentication(options =>
        {
            options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
        }).AddJwtBearer(options =>
            {
                options.Authority = $"https://{companyName}.okta.com";
                options.Audience = $"https://{companyName}.okta.com";
                options.RequireHttpsMetadata = false;
            });

```

And this doesn’t work, I get Response 401 (Unauthorized) every time. I also tried to play around with TokenValidationParameters changing values without a luck.

Any help would be much appreciated!

Thanks,  
Tibor

---

<div class="post-metadata">

**Author:** ![vijet](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/vijet/32/245_2.png) [@vijet](https://devforum.okta.com/u/vijet)\
**Post date:** [February 12, 2018, 3:50pm UTC](https://devforum.okta.com/t/verify-access-token-in-asp-net-core-2-0-backend-forwarded-from-angular-4-spa-openidc/1221/2 "2018-02-12T15:50:28Z")

</div>

Looking at your code in `startup.cs`, I suggest you try the following -

`options.Authority` is the authorization server that issued the access token. If you look at your front-end angular code (from the blog), it’s of the form - `https://{companyName}.okta.com/oauth2/default`  
Login to your okta org and verify that you do have this default auth server.  
If you have an Okta Developer Account, you already have a default auth Server created for you.

If you don’t have an existing authorizations server, or would like to create a new one, then you can find out how to do that in the [Setting up Auth Server](https://developer.okta.com/authentication-guide/implementing-authentication/set-up-authz-server) section

If you have the default auth server, change `options.Authority` to `https://{companyName}.okta.com/oauth2/default`

`options.Audience` should be the `api://default` (You can verify this in your okta org auth server setting. You can also change it to API that you’re protecting)

Disclaimer - I haven’t worked on .net, so I’m not sure if this alone will resolve your issue.  
@nate.barbettini - Mind taking a look? 🙂

---

<div class="post-metadata">

**Author:** ![nate.barbettini](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/nate.barbettini/32/385_2.png) [@nate.barbettini](https://devforum.okta.com/u/nate.barbettini)\
**Post date:** [February 12, 2018, 11:59pm UTC](https://devforum.okta.com/t/verify-access-token-in-asp-net-core-2-0-backend-forwarded-from-angular-4-spa-openidc/1221/3 "2018-02-12T23:59:44Z")

</div>

Yep, @vijet is correct. The Authority should be the full URL to the authorization server (matching what’s on the frontend). `RequireHttpsMetadata` is usually true as well.

FYI @bitibi, if you’re running the [ASP.NET](http://ASP.NET) Core backend from the command line with `dotnet run`, you can adjust the log level to Information in `appsettings.json` and get a full stack trace of exactly why a particular token failed (leading to a 401). That can be helpful when you are troubleshooting!

---

<div class="post-metadata">

**Author:** ![bitibi](https://avatars.discourse-cdn.com/v4/letter/b/c89c15/32.png) [@bitibi](https://devforum.okta.com/u/bitibi)\
**Post date:** [February 13, 2018, 8:52am UTC](https://devforum.okta.com/t/verify-access-token-in-asp-net-core-2-0-backend-forwarded-from-angular-4-spa-openidc/1221/4 "2018-02-13T08:52:19Z")

</div>

Thank you @vijet and @nate.barbettini !

You are right, the issue was Setting up Auth Server. I just joined a new company recently, have no full admin rights yet on Okta and couldn’t access the API menu option. However, I made a developer account to test and it works fine as you described!

Fantastic, thanks again!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 12, 2024, 8:24pm UTC](https://devforum.okta.com/t/verify-access-token-in-asp-net-core-2-0-backend-forwarded-from-angular-4-spa-openidc/1221/5 "2024-01-12T20:24:32Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.