title: ASP.Net Core SignalR bearer token on negotiate
body: <p>From reading the <a href="https://docs.microsoft.com/en-us/aspnet/core/signalr/authn-and-authz?view=aspnetcore-3.1" rel="nofollow noreferrer">Microsoft docs</a> on authentication with SignalR, it looks like the only way to authenticate using a bearer token is to send it in the query string on the WebSocket connection.</p>
  
  <p>Upon inspecting the SignalR handshake, it looks like the Authorization header is included in the Negotiate call. Since the connection ID is returned in the negotiate response, the server could keep track of whether that connection ID has authenticated.</p>
  
  <p>Why is it required to add the bearer token to the Websocket connection query string as well?</p>