title: How to make JWT token authorization optional in controller methods
body: <p>I use JWT tokens in my ASP.NET Core 2 web application</p>
  
  <p>If the JWT token fails I still want the controller method to be hit but the ASP.NET Identity <code>User</code> object will just be null. Currently the controller method won't get entered if authentication fails so I can't apply logic inside the method to deal with non authenticated users which I want to deal with as guests instead of blocking them.</p>
  
  <p>My code:</p>
  
  <p>Startup.cs</p>
  
  <pre><code>    public void ConfigureServices(IServiceCollection services)
      {
  
          services.AddAuthentication()
              .AddJwtBearer(cfg =&gt;
              {
                  cfg.TokenValidationParameters = new TokenValidationParameters()
                  {
                      ValidIssuer = _config["Tokens:Issuer"],
                      ValidAudience = _config["Tokens:Audience"],
                      IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_config["Tokens:Key"]))
                  };
  
              });
  </code></pre>
  
  <p>When a user logs in</p>
  
  <pre><code>   private IActionResult CreateToken(ApplicationUser user, IList&lt;string&gt; roles)
      {
          var claims = new List&lt;Claim&gt;
          {
            new Claim(JwtRegisteredClaimNames.Sub, user.Id.ToString()),
            new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
            new Claim(JwtRegisteredClaimNames.UniqueName, user.UserName)
          };
  
  
  
          var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_config["Tokens:Key"]));
  
          var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
  
          var token = new JwtSecurityToken(
            _config["Tokens:Issuer"],
            _config["Tokens:Audience"],
            claims.ToArray(),
           expires: DateTime.Now.AddMinutes(60),
            signingCredentials: creds);
  
          var results = new
          {
              token = new JwtSecurityTokenHandler().WriteToken(token),
              expiration = token.ValidTo,
          };
  
          return Created("", results);
  </code></pre>
  
  <p>I make sure after authenticated the various API calls pass the JWT token.</p>
  
  <p>In my Controller I make use of an Authorize attribute</p>
  
  <pre><code>[Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]
   public class MyController : Controller
  {
  </code></pre>
  
  <p>This allows me to capture the logged in user with the following code for the various API calls</p>
  
  <pre><code> var loggedInUser = User.Identity.Name;
  </code></pre>
  
  <p>If I remove the authorize attribute then <code>User.Identity.Name</code> will always be null even if the user is authenticated.</p>
  
  <p>How do I use the authorize attribute but still allow the controller method to be entered if the token is not valid? I want to use the same method for both Authorized and non Authorized users to be entered. I will then use the <code>User.Identity.Name</code> to determine if they are not authenticated and have guest user logic inside the method for them.</p>