title: Not able to validate JSON Web Token with .NET – key too short
body: <p>I have used <code>JSONWebToken</code> npm module to generate a jwt:</p>
  
  <pre><code>var jwt = require('jsonwebtoken');
  
  var payload = {
      "iss": "https://secure.example.com/",
      "exp": 1410819380,
      "http://example.com/orgnum": "987987987",
      "http://example.com/user": "me@example.com"
  };
  
  var token = jwt.sign(payload, 'secret');
  
  console.log(token);
  </code></pre>
  
  <p>This gives me the following output:</p>
  
  <blockquote>
    <p>eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3NlY3VyZS5leGFtcGxlLmNvbS8iLCJleHAiOjE0MTA4MTkzODAsImh0dHA6Ly9leGFtcGxlLmNvbS9vcmdudW0iOiI5ODc5ODc5ODciLCJodHRwOi8vZXhhbXBsZS5jb20vdXNlciI6Im1lQGV4YW1wbGUuY29tIiwiaWF0IjoxNDA4Mzk0Mjk2fQ.5X5LTg4wxDF2p49xtsRcG4S9Yk4qSfW1tMEU0AquBhc</p>
  </blockquote>
  
  <p>Since I'm not specifying what algorithm I want, it uses SHA256.</p>
  
  <p>Now, I try to verify this in c#. That didn't turn out easy...</p>
  
  <p>I get an exception about the key size:</p>
  
  <blockquote>
    <p>IDX10603: The 'System.IdentityModel.Tokens.InMemorySymmetricSecurityKey' cannot have less than: '128' bits.
    Parameternavn: key.KeySize
    The actual size was 48.</p>
  </blockquote>
  
  <p>I I try to extend the key, I get a new error when creating the symmetric key:</p>
  
  <blockquote>
    <p>Invalid length for a Base-64 char array or string</p>
  </blockquote>
  
  <p>I recon this has something to do with the way I'm telling the .net code about my key. Since the <code>SymmetricKeyIssuerSecurityTokenProvider</code> constructor parameter is named <code>base64Key</code>, I have tryed to Base64Url-encode my key:</p>
  
  <pre><code>        var secret =  Base64UrlEncoder.Encode("secret");
          TokenValidationParameters validationParameters = new TokenValidationParameters
          {                
              ValidateIssuer = false,
              ValidateAudience = false,
              IssuerSigningTokens = new SymmetricKeyIssuerSecurityTokenProvider(issuer, secret).SecurityTokens
          };
  </code></pre>
  
  <p><strong>So, what are I missing here?<br>
  Why can <code>jsonwebtoken</code> generate and validate jots with short keys while .net can not?<br>
  And why can't .net accept the keys I give it?</strong></p>
  
  <p>Here's the complete .net code with a jot signed with a long key:</p>
  
  <pre><code>        var jwtToken =
              "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3NlY3VyZS5leGFtcGxlLmNvbS8iLCJleHAiOjE0MTA4MTkzODAsImh0dHA6Ly9leGFtcGxlLmNvbS9vcmdudW0iOiI5ODc5ODc5ODciLCJodHRwOi8vZXhhbXBsZS5jb20vdXNlciI6Im1lQGV4YW1wbGUuY29tIiwiaWF0IjoxNDA4Mzk1NjY4fQ.ZceiiEO_Mn5_GZp5D_r68VTT33fbocn1BTTznD6u3cs";
          var secret = Base64UrlEncoder.Encode("super duper secret with some more on top");
  
  
          TokenValidationParameters validationParameters = new TokenValidationParameters
              {
                  ValidateIssuer = false,
                  ValidateAudience = false,
                  IssuerSigningTokens = new SymmetricKeyIssuerSecurityTokenProvider("issuer", secret).SecurityTokens
              };
  
  
          JwtSecurityTokenHandler tokenHandler = new JwtSecurityTokenHandler()
              {
                  Configuration = new SecurityTokenHandlerConfiguration()
                      {
                          CertificateValidationMode = X509CertificateValidationMode.None
                      }
              };
  
          SecurityToken validatedToken;
          var claimsPrincipal = tokenHandler.ValidateToken(jwtToken, validationParameters, out validatedToken);
          return claimsPrincipal.Claims;
  </code></pre>
  
  <p><strong>Updated:</strong>  </p>
  
  <p>I'm only using Microsoft-stuff in this code.  I'm using the <code>Owin</code> packages <code>Microsoft.Owin.Security.Jwt</code> version <code>2.1.0</code> with <code>System.IdentityModel.Tokens.Jwt</code> version <code>4.0.0-RC2</code>.</p>
  
  <p>There are multiple blog posts out there stating that you'll need to manually update the <code>System.IdentityModel.Tokens.Jwt</code> package.</p>