From 4f3efddbb09a29635fff305465e3639d882db5d8 Mon Sep 17 00:00:00 2001 From: Michael Crawford Date: Sun, 13 Sep 2026 11:13:46 -0400 Subject: [PATCH] Document JWT revocation checks for non-header tokens and unrouted requests JwtRevocationMiddleware now also checks the token accepted by the JWT bearer handler (query string, cookie) and requests with no matched endpoint. Note the SaveToken requirement for apps that call AddJwtBearer() directly. Co-Authored-By: Claude Opus 5 --- src/content/docs/03-security.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/content/docs/03-security.md b/src/content/docs/03-security.md index 4a91eaea..299ceb08 100644 --- a/src/content/docs/03-security.md +++ b/src/content/docs/03-security.md @@ -549,6 +549,10 @@ app.UseJwtRevocation() //must come before auth middleware .UseAuthorization() ``` +Endpoints that allow anonymous access are not checked. Every other request is checked, including requests that haven't been matched to an endpoint yet. + +The middleware checks the token in the `Authorization` header, as well as the token the JWT bearer handler actually accepted. So tokens your app reads from the query string or a cookie in `JwtBearerEvents.OnMessageReceived` (such as for SSE or SignalR clients) are checked too. This requires `JwtBearerOptions.SaveToken` to be enabled. `AddAuthenticationJwtBearer()` enables it by default. If you configure JWT bearer auth with `AddJwtBearer()` directly and accept tokens from other sources, set `SaveToken = true` yourself. + The default response can be overridden like so: ```csharp