Cookie authentication not working properly with JWT authentication ASP.NET CORE - asp.net-core

Question

I am practicing writing web applications using ASP.NET CORE and I came across a problem with Identity. I tried searching online to see if someone else has had such a problem to no avail.
I have built a simple web api that uses JWT for authentication and everything works perfectly. But I needed to also enable users to login using forms i.e cookie authentication. The following is my configure services method.
private static void ConfigureJwt(IConfiguration configuration, IServiceCollection services)
{
services.AddSingleton<JwtSettings>();
services.AddAuthentication(options =>
{
options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
}).AddCookie( conf =>
{
conf.SlidingExpiration = true;
conf.LoginPath = "/account/login";
conf.LogoutPath = "/account/logout";
})
.AddJwtBearer(options =>
{
options.SaveToken = true;
options.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuerSigningKey = true,
IssuerSigningKey =
new SymmetricSecurityKey(Encoding.ASCII.GetBytes("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")),
ValidateAudience = false,
ValidateIssuer = false,
RequireExpirationTime = false,
ValidateLifetime = true,
ClockSkew = TimeSpan.Zero,
ValidateActor = true
};
});
}
So, since the DefaultChallengeScheme is set to "JwtBearerDefaults.AuthenticationScheme" I assumed that, if I wanted to authorize a user who has logged in using cookie authentication, I should just specify the cookie authentication scheme in that particular controller method like below.
[Route("[controller]/[action]")]
[Authorize(AuthenticationSchemes = CookieAuthenticationDefaults.AuthenticationScheme)]
public class HomeController : Controller
{
// GET
[HttpGet]
public IActionResult Index()
{
return View();
}
}
But I am always redirected to the login page.
The only way I got this to work is when I remove the default authentication settings
private static void ConfigureJwt(IConfiguration configuration, IServiceCollection services)
{
var jwtSettings = new JwtSettings();
configuration.Bind(nameof(JwtSettings), jwtSettings);
services.AddSingleton<JwtSettings>();
services.AddAuthentication()
.AddCookie( conf =>
{
conf.SlidingExpiration = true;
conf.LoginPath = "/account/login";
conf.LogoutPath = "/account/logout";
})
.AddJwtBearer("jwt", options =>
{
options.SaveToken = true;
options.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuerSigningKey = true,
IssuerSigningKey =
new SymmetricSecurityKey(Encoding.ASCII.GetBytes("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")),
ValidateAudience = false,
ValidateIssuer = false,
RequireExpirationTime = false,
ValidateLifetime = true,
ClockSkew = TimeSpan.Zero,
ValidateActor = true
};
});
}
Then use the normal [Authorize] attribute on cookie related routes
[Route("[controller]/[action]")]
[Authorize]
public class HomeController : Controller
{
// GET
[HttpGet]
public IActionResult Index()
{
return View();
}
}
Then in all my API routes, I specified the JWT's authentication scheme
[Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]
[HttpGet(ApiRoutes.Posts.GetAll)]
public async Task<IActionResult> GetAll()
{
var posts = await _postService.GetAllAsync();
return Ok(posts);
}
So my question is, why didn't the initial configuration work? And since my app mainly JWT uses authentication, I would like for it to be the default authentication scheme and only specify cookie authentication scheme in few controller methods since it's rarely used. Is this possible? If yes, how can I achieve this?

Answer 1

After more digging, I stumbled on this thread, which answered my question.
I had misunderstood how authentication works in an asp.net core app that uses identity.
When you use Identity to authenticate and login a user, the default authentication scheme used is called "Identity.Applicaiton" and not "Cookies".
var result = await _signInManager.PasswordSignInAsync(loginModel.Email, loginModel.Password, true, false);
if (result.Succeeded)
{
return LocalRedirect("/home/index");
}
But if you want to use the "Cookies" authentication scheme, you have to authenticate and login a user using HttpContext.SignInAsync as seen below and explicitly select "Cookies" as your authentication scheme.
var claims = new[]
{
new Claim("email", user.Email),
};
var identity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme,
new ClaimsPrincipal(identity));