Fast.JwtBearer public API

Targets: net8.0;net9.0;net10.0. This is a declaration and XML-comment reference. See the module guide for usage and constraints.

Source commit: 43554c07f6c216f80b509bd535c0a5b66ae7f2e8. Maintained through scripts/export-dotnet-api.ps1 -Language en; ordinary site builds consume this file directly.

Fast.JwtBearer.AllowForbiddenAttribute

Source · Targets: net8.0, net9.0, net10.0

[SuppressSniffer]
[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
public class AllowForbiddenAttribute : Attribute

Allows access without permission (403)

Fast.JwtBearer.AllowForbiddenAttribute.ToString

Source · Targets: net8.0, net9.0, net10.0

public override string ToString()

Documentation is inherited from an interface or base class; consult that declaration.

Microsoft.AspNetCore.Authorization.PermissionAttribute

Source · Targets: net8.0, net9.0, net10.0

[SuppressSniffer]
[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
public class PermissionAttribute : Attribute

Permission

Microsoft.AspNetCore.Authorization.PermissionAttribute.TagList

Source · Targets: net8.0, net9.0, net10.0

public List<string> TagList { get; set; }

Permission identifiers

Microsoft.AspNetCore.Authorization.PermissionAttribute.PermissionAttribute

Source · Targets: net8.0, net9.0, net10.0

public PermissionAttribute()

Permission

Microsoft.AspNetCore.Authorization.PermissionAttribute.PermissionAttribute

Source · Targets: net8.0, net9.0, net10.0

public PermissionAttribute(params string[] tagList)

Permission

• Parameter tagList: Tags used for permission matching

Fast.JwtBearer.JwtBearerAlgorithmEnum

Source · Targets: net8.0, net9.0, net10.0

[FastEnum("JwtBearer 加密算法")]
public enum JwtBearerAlgorithmEnum : byte

JwtBearer cryptographic algorithm

Fast.JwtBearer.JwtBearerAlgorithmEnum.HS256

Source · Targets: net8.0, net9.0, net10.0

[Description("HS256")]
    HS256 = 0

HS256, the default

Fast.JwtBearer.JwtBearerAlgorithmEnum.HS384

Source · Targets: net8.0, net9.0, net10.0

[Description("HS384")]
    HS384 = 1

HS384

Fast.JwtBearer.JwtBearerAlgorithmEnum.HS512

Source · Targets: net8.0, net9.0, net10.0

[Description("HS512")]
    HS512 = 2

HS512

Fast.JwtBearer.JwtBearerAlgorithmEnum.PS256

Source · Targets: net8.0, net9.0, net10.0

[Description("PS256")]
    PS256 = 3

PS256

Fast.JwtBearer.JwtBearerAlgorithmEnum.PS384

Source · Targets: net8.0, net9.0, net10.0

[Description("PS384")]
    PS384 = 4

PS384

Fast.JwtBearer.JwtBearerAlgorithmEnum.PS512

Source · Targets: net8.0, net9.0, net10.0

[Description("PS512")]
    PS512 = 5

PS512

Fast.JwtBearer.JwtBearerAlgorithmEnum.ES256

Source · Targets: net8.0, net9.0, net10.0

[Description("ES256")]
    ES256 = 6

ES256

Fast.JwtBearer.JwtBearerAlgorithmEnum.ES256K

Source · Targets: net8.0, net9.0, net10.0

[Description("ES256K")]
    ES256K = 7

ES256K

Fast.JwtBearer.JwtBearerAlgorithmEnum.ES384

Source · Targets: net8.0, net9.0, net10.0

[Description("ES384")]
    ES384 = 8

ES384

Fast.JwtBearer.JwtBearerAlgorithmEnum.ES512

Source · Targets: net8.0, net9.0, net10.0

[Description("ES512")]
    ES512 = 9

ES512

Fast.JwtBearer.JwtBearerAlgorithmEnum.EdDSA

Source · Targets: net8.0, net9.0, net10.0

[Description("EdDSA")]
    EdDSA = 10

EdDSA

Fast.JwtBearer.IServiceCollectionExtension

Source · Targets: net8.0, net9.0, net10.0

[SuppressSniffer]
public static class IServiceCollectionExtension

Dynamic API extensions for IServiceCollection

Fast.JwtBearer.IServiceCollectionExtension.AddJwtBearerSetting

Source · Targets: net8.0, net9.0, net10.0

public static IServiceCollection AddJwtBearerSetting(this IServiceCollection services, IConfiguration configuration,
        string section = "JWTSettings")

Adds JwtBearer settings

Remarks: For applications using only the utilities

• Parameter services: The service collection to add services to
• Parameter configuration: Configuration used to read module settings
• Parameter section: JSON configuration section key; defaults to JWTSettings
• Returns: Returns services for chaining

Fast.JwtBearer.IServiceCollectionExtension.AddJwtBearerSetting

Source · Targets: net8.0, net9.0, net10.0

public static IServiceCollection AddJwtBearerSetting(this IServiceCollection services,
        Action<JWTSettingsOptions> optionAction)

Adds JwtBearer settings

Remarks: For applications using only the utilities

• Parameter services: The service collection to add services to
• Parameter optionAction: JWT configuration callback
• Returns: Returns services for chaining

Fast.JwtBearer.IServiceCollectionExtension.AddJwtBearerAuthentication

Source · Targets: net8.0, net9.0, net10.0

public static IServiceCollection AddJwtBearerAuthentication(this IServiceCollection services, IConfiguration configuration,
        string section = "JWTSettings")

Adds JwtBearer authorization

Remarks: For custom validation

• Parameter services: The service collection to add services to
• Parameter configuration: Configuration used to read module settings
• Parameter section: JSON configuration section key; defaults to JWTSettings
• Returns: Returns services for chaining

Fast.JwtBearer.IServiceCollectionExtension.AddJwtBearerAuthentication

Source · Targets: net8.0, net9.0, net10.0

public static IServiceCollection AddJwtBearerAuthentication(this IServiceCollection services,
        Action<JWTSettingsOptions> optionAction)

Adds JwtBearer authorization

Remarks: For custom validation

• Parameter services: The service collection to add services to
• Parameter optionAction: JWT configuration callback
• Returns: Returns services for chaining

Fast.JwtBearer.IServiceCollectionExtension.AddJwtBearer

Source · Targets: net8.0, net9.0, net10.0

public static IServiceCollection AddJwtBearer(this IServiceCollection services, IConfiguration configuration,
        string section = "JWTSettings")

Adds JwtBearer services

• Parameter services: The service collection to add services to
• Parameter configuration: Configuration used to read module settings
• Parameter section: JSON configuration section key; defaults to JWTSettings
• Returns: Returns services for chaining

Fast.JwtBearer.IServiceCollectionExtension.AddJwtBearer

Source · Targets: net8.0, net9.0, net10.0

public static IServiceCollection AddJwtBearer(this IServiceCollection services, Action<JWTSettingsOptions> optionAction)

Adds JwtBearer services

• Parameter services: The service collection to add services to
• Parameter optionAction: JWT configuration callback
• Returns: Returns services for chaining

Fast.JwtBearer.IJwtBearerHandle

Source · Targets: net8.0, net9.0, net10.0

[SuppressSniffer]
public interface IJwtBearerHandle

Defines custom JWT authentication and permission-checking contracts

Fast.JwtBearer.IJwtBearerHandle.AuthorizeHandle

Source · Targets: net8.0, net9.0, net10.0

Task<bool> AuthorizeHandle(AuthorizationHandlerContext context, HttpContext httpContext);

Performs additional authorization checks after authentication

Remarks: Token validation and automatic refresh have completed before this call. Returning false or throwing invokes AuthorizeFailHandle; if that handler provides no response, the framework calls AuthorizationHandlerContext.Fail().

• Parameter context: Current authorization context
• Parameter httpContext: Current request context
• Returns: Returns true when authorization succeeds; false or an exception enters failure handling

Fast.JwtBearer.IJwtBearerHandle.AuthorizeFailHandle

Source · Targets: net8.0, net9.0, net10.0

Task<object> AuthorizeFailHandle(AuthorizationHandlerContext context, HttpContext httpContext, Exception exception);

Creates custom response data for authentication failure

Remarks: Non-null data is written with HTTP 401; null causes AuthorizationHandlerContext.Fail()

• Parameter context: Current authorization context
• Parameter httpContext: Current request context
• Parameter exception: Exception thrown during authentication checks, or null if none was caught
• Returns: Custom response data; return null for default failure handling

Fast.JwtBearer.IJwtBearerHandle.PermissionHandle

Source · Targets: net8.0, net9.0, net10.0

Task<bool> PermissionHandle(AuthorizationHandlerContext context, IAuthorizationRequirement requirement,
        HttpContext httpContext);

Checks whether the current request satisfies the specified authorization requirement

Remarks: Returning false or throwing invokes PermissionFailHandle

• Parameter context: Current authorization context
• Parameter requirement: Authorization requirement to validate
• Parameter httpContext: Current request context
• Returns: Returns true when permission checks succeed; false or an exception enters failure handling

Fast.JwtBearer.IJwtBearerHandle.PermissionFailHandle

Source · Targets: net8.0, net9.0, net10.0

Task<object> PermissionFailHandle(AuthorizationHandlerContext context, IAuthorizationRequirement requirement,
        HttpContext httpContext, Exception exception);

Creates custom response data for permission-check failure

Remarks: Non-null data is written with HTTP 403; null causes AuthorizationHandlerContext.Fail()

• Parameter context: Current authorization context
• Parameter requirement: Authorization requirement that failed validation
• Parameter httpContext: Current request context
• Parameter exception: Exception thrown during permission checks, or null if none was caught
• Returns: Custom response data; return null for default failure handling

Fast.JwtBearer.JWTSettingsOptions

Source · Targets: net8.0, net9.0, net10.0

[SuppressSniffer]
public sealed class JWTSettingsOptions : IPostConfigure

JWT configuration

Fast.JwtBearer.JWTSettingsOptions.ValidateIssuerSigningKey

Source · Targets: net8.0, net9.0, net10.0

public bool? ValidateIssuerSigningKey { get; set; }

Validate the issuer signing key

Remarks: Defaults to true

Fast.JwtBearer.JWTSettingsOptions.IssuerSigningKey

Source · Targets: net8.0, net9.0, net10.0

public string IssuerSigningKey { get; set; }

Issuer signing key

Fast.JwtBearer.JWTSettingsOptions.ValidateIssuer

Source · Targets: net8.0, net9.0, net10.0

public bool? ValidateIssuer { get; set; }

Validate the issuer

Remarks: Defaults to true

Fast.JwtBearer.JWTSettingsOptions.ValidIssuer

Source · Targets: net8.0, net9.0, net10.0

public string ValidIssuer { get; set; }

Issuer

Fast.JwtBearer.JWTSettingsOptions.ValidateAudience

Source · Targets: net8.0, net9.0, net10.0

public bool? ValidateAudience { get; set; }

Validate the audience

Remarks: Defaults to true

Fast.JwtBearer.JWTSettingsOptions.ValidAudience

Source · Targets: net8.0, net9.0, net10.0

public string ValidAudience { get; set; }

Audience

Fast.JwtBearer.JWTSettingsOptions.ValidateLifetime

Source · Targets: net8.0, net9.0, net10.0

public bool? ValidateLifetime { get; set; }

Validate token lifetime

Remarks: Defaults to true

Fast.JwtBearer.JWTSettingsOptions.ValidateAccessToken

Source · Targets: net8.0, net9.0, net10.0

public bool? ValidateAccessToken { get; set; }

Validate AccessToken

Remarks: Defaults to false; validation requires calling JwtBearerUtil.SetExpiredToken

Fast.JwtBearer.JWTSettingsOptions.ClockSkew

Source · Targets: net8.0, net9.0, net10.0

public long? ClockSkew { get; set; }

Clock-skew tolerance in seconds for unsynchronized server clocks

Remarks: Defaults to 5 seconds

Fast.JwtBearer.JWTSettingsOptions.TokenExpiredTime

Source · Targets: net8.0, net9.0, net10.0

public long? TokenExpiredTime { get; set; }

Token lifetime in minutes

Remarks: Defaults to 20 minutes

Fast.JwtBearer.JWTSettingsOptions.RefreshTokenExpireTime

Source · Targets: net8.0, net9.0, net10.0

public long? RefreshTokenExpireTime { get; set; }

Refresh token lifetime in minutes

Remarks: Defaults to 1440 minutes (24 hours)

Fast.JwtBearer.JWTSettingsOptions.RequireRefreshTokenCache

Source · Targets: net8.0, net9.0, net10.0

public bool? RequireRefreshTokenCache { get; set; }

Whether refresh operations require distributed-cache replay validation

Remarks: Defaults to true. Standard registration falls back to an in-process cache when no shared cache is configured. If an application bypasses standard registration and provides no IDistributedCache, refresh is rejected to prevent refresh-token reuse. Multi-instance deployments should use a shared cache such as Redis rather than an in-process cache.

Fast.JwtBearer.JWTSettingsOptions.Algorithm

Source · Targets: net8.0, net9.0, net10.0

public JwtBearerAlgorithmEnum? Algorithm { get; set; }

Cryptographic algorithm

Remarks: Defaults to HS256

Fast.JwtBearer.JWTSettingsOptions.Enable

Source · Targets: net8.0, net9.0, net10.0

public bool? Enable { get; set; }

Enabled

Remarks: Defaults to true

Fast.JwtBearer.JWTSettingsOptions.PostConfigure

Source · Targets: net8.0, net9.0, net10.0

public void PostConfigure()

Documentation is inherited from an interface or base class; consult that declaration.

Fast.JwtBearer.AppAuthorizeRequirement

Source · Targets: net8.0, net9.0, net10.0

[SuppressSniffer]
public sealed class AppAuthorizeRequirement : IAuthorizationRequirement

Requirement associated with the policy

Fast.JwtBearer.AppAuthorizeRequirement.AppAuthorizeRequirement

Source · Targets: net8.0, net9.0, net10.0

public AppAuthorizeRequirement(params string[] policies)

Initializes a new instance of the class

• Parameter policies: Authorization policy names

Fast.JwtBearer.AppAuthorizeRequirement.Policies

Source · Targets: net8.0, net9.0, net10.0

public string[] Policies { get; private set; }

Policy

Fast.JwtBearer.JwtBearerUtil

Source · Targets: net8.0, net9.0, net10.0

public static class JwtBearerUtil

JwtBearer utilities

`Fast.JwtBearer.JwtBearerUtil.DateTypeClaimTypes =

[
    JwtRegisteredClaimNames.Iat, JwtRegisteredClaimNames.Nbf, JwtRegisteredClaimNames.Exp
]`

Source · Targets: net8.0, net9.0, net10.0

public static readonly string[] DateTypeClaimTypes =
    [
        JwtRegisteredClaimNames.Iat, JwtRegisteredClaimNames.Nbf, JwtRegisteredClaimNames.Exp
    ];

Date-valued claim type

Fast.JwtBearer.JwtBearerUtil.RefreshTokenClaims = ["f", "e", "s", "l", "k"]

Source · Targets: net8.0, net9.0, net10.0

public static readonly string[] RefreshTokenClaims = ["f", "e", "s", "l", "k"];

Refresh-token identity marker

Fast.JwtBearer.JwtBearerUtil.CreateTokenValidationParameters

Source · Targets: net8.0, net9.0, net10.0

public static TokenValidationParameters CreateTokenValidationParameters(JWTSettingsOptions jwtSettings)

Creates token validation parameters

• Parameter jwtSettings: JWT issuance and validation settings
• Returns: Generated token validation parameters

Fast.JwtBearer.JwtBearerUtil.GenerateToken

Source · Targets: net8.0, net9.0, net10.0

public static string GenerateToken(IDictionary<string, object> payload, long? expiredTime = null)

Generates a token

• Parameter payload: Payload to write into the token
• Parameter expiredTime: Token expiration time
• Returns: Generated token

Fast.JwtBearer.JwtBearerUtil.GenerateRefreshToken

Source · Targets: net8.0, net9.0, net10.0

public static string GenerateRefreshToken(string accessToken)

Generates a refresh token

• Parameter accessToken: Access token
• Returns: Generated refresh token

Fast.JwtBearer.JwtBearerUtil.GetJwtBearerToken

Source · Targets: net8.0, net9.0, net10.0

public static string GetJwtBearerToken(HttpContext httpContext, string headerKey = "Authorization",
        string tokenPrefix = "Bearer ")

Gets the JWT bearer token

• Parameter httpContext: Current request context
• Parameter headerKey: Name of the request header carrying the token
• Parameter tokenPrefix: Prefix before the token in the request header
• Returns: JWT bearer token retrieved

Fast.JwtBearer.JwtBearerUtil.Validate

Source · Targets: net8.0, net9.0, net10.0

public static (bool IsValid, JsonWebToken Token, TokenValidationResult validationResult) Validate(string accessToken)

Validates a token

• Parameter accessToken: Access token
• Returns: Validates a token

Fast.JwtBearer.JwtBearerUtil.ValidateAsync

Source · Targets: net8.0, net9.0, net10.0

public static async Task<(bool IsValid, JsonWebToken Token, TokenValidationResult validationResult)> ValidateAsync(
        string accessToken)

Asynchronously validates a token

• Parameter accessToken: Access token
• Returns: A task whose result is the token validation result

Fast.JwtBearer.JwtBearerUtil.ValidateJwtBearerToken

Source · Targets: net8.0, net9.0, net10.0

public static bool ValidateJwtBearerToken(DefaultHttpContext httpContext, out JsonWebToken token,
        string headerKey = "Authorization", string tokenPrefix = "Bearer ")

Validates a token

• Parameter httpContext: Current request context
• Parameter token: Token to parse or validate
• Parameter headerKey: Name of the request header carrying the token
• Parameter tokenPrefix: Prefix before the token in the request header
• Returns: Returns true when the request contains a valid access token; otherwise false

Fast.JwtBearer.JwtBearerUtil.ReadJwtToken

Source · Targets: net8.0, net9.0, net10.0

public static JsonWebToken ReadJwtToken(string accessToken)

Reads a token without validation

• Parameter accessToken: Access token
• Returns: Token read without validation

Fast.JwtBearer.JwtBearerUtil.SecurityReadJwtToken

Source · Targets: net8.0, net9.0, net10.0

public static JwtSecurityToken SecurityReadJwtToken(string accessToken)

Reads a token

Remarks: Only parses the token; it does not validate the signature, issuer, or expiration. Use Validate for security decisions

• Parameter accessToken: Access token
• Returns: Token read

Fast.JwtBearer.JwtBearerUtil.Exchange

Source · Targets: net8.0, net9.0, net10.0

public static string Exchange(HttpContext httpContext, string expiredToken, string refreshToken, long? expiredTime = null,
        long? clockSkew = null)

Exchanges an expired access token and a refresh token for a new token

• Parameter httpContext: Current request context
• Parameter expiredToken: Expired access token whose signature must still be validated
• Parameter refreshToken: Refresh token
• Parameter expiredTime: Token expiration time
• Parameter clockSkew: Allowed clock skew for token validation
• Returns: Exchanges an expired access token and a refresh token for a new token

Fast.JwtBearer.JwtBearerUtil.ExchangeAsync

Source · Targets: net8.0, net9.0, net10.0

public static async Task<string> ExchangeAsync(HttpContext httpContext, string expiredToken, string refreshToken,
        long? expiredTime = null, long? clockSkew = null)

Asynchronously exchanges an expired access token and a refresh token for a new token

• Parameter httpContext: Current request context
• Parameter expiredToken: Expired access token whose signature must still be validated
• Parameter refreshToken: Refresh token
• Parameter expiredTime: Token expiration time
• Parameter clockSkew: Allowed clock skew for token validation
• Returns: A task whose result is the replacement token

Fast.JwtBearer.JwtBearerUtil.SetExpiredToken

Source · Targets: net8.0, net9.0, net10.0

public static void SetExpiredToken(HttpContext httpContext, string expiredToken)

Marks a token as expired

• Parameter httpContext: Current request context
• Parameter expiredToken: Expired access token whose signature must still be validated

Fast.JwtBearer.JwtBearerUtil.SetExpiredTokenAsync

Source · Targets: net8.0, net9.0, net10.0

public static async Task SetExpiredTokenAsync(HttpContext httpContext, string expiredToken)

Asynchronously marks a token as invalid

• Parameter httpContext: Current request context
• Parameter expiredToken: Expired access token whose signature must still be validated
• Returns: A task representing the asynchronous token invalidation operation

Fast.JwtBearer.JwtBearerUtil.AutoRefreshToken

Source · Targets: net8.0, net9.0, net10.0

public static bool AutoRefreshToken(AuthorizationHandlerContext context, HttpContext httpContext, long? expiredTime = null,
        string tokenPrefix = "Bearer ", long? clockSkew = null)

Automatically refreshes token information

• Parameter context: Current authorization context
• Parameter httpContext: Current request context
• Parameter expiredTime: Token expiration time
• Parameter tokenPrefix: Prefix before the token in the request header
• Parameter clockSkew: Compatibility tolerance in seconds for repeated submission of the same refresh token; defaults to 0 (replay prohibited)
• Returns: Returns true when new tokens are successfully issued and written; false when refresh is unnecessary or fails

Fast.JwtBearer.JwtBearerUtil.AutoRefreshTokenAsync

Source · Targets: net8.0, net9.0, net10.0

public static async Task<bool> AutoRefreshTokenAsync(AuthorizationHandlerContext context, HttpContext httpContext,
        long? expiredTime = null, string tokenPrefix = "Bearer ", long? clockSkew = null)

Asynchronously refreshes token information automatically

• Parameter context: Current authorization context
• Parameter httpContext: Current request context
• Parameter expiredTime: Token expiration time
• Parameter tokenPrefix: Prefix before the token in the request header
• Parameter clockSkew: Allowed clock skew for token validation
• Returns: Returns true when new tokens are successfully issued and written; false when refresh is unnecessary or fails