How to override OnForbidden property while creating JwtBearerEvents

[wanjuntham]

Hello, I have been consuming JwtBearer nuget package to enable oauth2 flow for my application. I want to override the returned response body when scope of jwt is invalid.

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(options =>
         {
               options.Events = new JwtBearerEvents
               {
                    OnMessageReceived = context =>
                    {
                        Debug.WriteLine("message received!");
                        return Task.CompletedTask;
                    },
                    OnChallenge = context =>
                    {
                        context.HandleResponse();
                        Debug.WriteLine("Challenged!" + context.AuthenticateFailure.Message);
                        context.Error = "invalid_token";
                        context.ErrorDescription = context.AuthenticateFailure.Message;
                        context.Response.StatusCode = 401;
                        context.Response.ContentType = "text/plain";
                        return context.Response.WriteAsync("Error: " + context.ErrorDescription);
                    },
                    OnForbidden = context =>
                    {
                        Debug.WriteLine("Forbidden jwt!");
                        context.Response.WriteAsync("invalid scope");
                        context.Response.ContentType = "text/plain";
                        context.Response.StatusCode = (int)HttpStatusCode.BadRequest;
                        // same exception for using/not using HttpContext property
                        //context.HttpContext.Response.WriteAsync("invalid scope");
                        //context.HttpContext.Response.ContentType = "text/plain";
                        //context.HttpContext.Response.StatusCode = (int)HttpStatusCode.BadRequest;
                        return Task.CompletedTask;
                    }
                };
           });

While im trying to pass a jwt with invalid scope, it didnt respond with the expected body, but an empty body. Also, it throws an exception before returning the response.

Forbidden jwt!
Exception thrown: 'System.InvalidOperationException' in Microsoft.AspNetCore.Server.IIS.dll
An exception of type 'System.InvalidOperationException' occurred in Microsoft.AspNetCore.Server.IIS.dll but was not handled in user code
The response headers cannot be modified because the response has already started.

Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware: Error: An unhandled exception has occurred while executing the request.

System.InvalidOperationException: The response headers cannot be modified because the response has already started.
   at Microsoft.AspNetCore.HttpSys.Internal.HeaderCollection.ThrowIfReadOnly()
   at Microsoft.AspNetCore.HttpSys.Internal.HeaderCollection.set_Item(String key, StringValues value)
   at Microsoft.AspNetCore.Http.DefaultHttpResponse.set_ContentType(String value)
   at OAuth2_OIDC.Startup.<>c.<ConfigureServices>b__6_6(ForbiddenContext context) in C:\Users\wan_jun_tham\source\repos\Playground\OAuth2-OIDC\Startup.cs:line 102
   at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerEvents.Forbidden(ForbiddenContext context)
   at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.HandleForbiddenAsync(AuthenticationProperties properties)
   at Microsoft.AspNetCore.Authentication.AuthenticationHandler`1.ForbidAsync(AuthenticationProperties properties)
   at Microsoft.AspNetCore.Authentication.AuthenticationService.ForbidAsync(HttpContext context, String scheme, AuthenticationProperties properties)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)
Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware: Warning: The response has already started, the error page middleware will not be executed.
Microsoft.AspNetCore.Server.IIS.Core.IISHttpServer: Error: Connection ID "", Request ID "": An unhandled exception was thrown by the application.

System.InvalidOperationException: The response headers cannot be modified because the response has already started.
   at Microsoft.AspNetCore.HttpSys.Internal.HeaderCollection.ThrowIfReadOnly()
   at Microsoft.AspNetCore.HttpSys.Internal.HeaderCollection.set_Item(String key, StringValues value)
   at Microsoft.AspNetCore.Http.DefaultHttpResponse.set_ContentType(String value)
   at OAuth2_OIDC.Startup.<>c.<ConfigureServices>b__6_6(ForbiddenContext context) in C:\Users\wan_jun_tham\source\repos\Playground\OAuth2-OIDC\Startup.cs:line 102
   at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerEvents.Forbidden(ForbiddenContext context)
   at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.HandleForbiddenAsync(AuthenticationProperties properties)
   at Microsoft.AspNetCore.Authentication.AuthenticationHandler`1.ForbidAsync(AuthenticationProperties properties)
   at Microsoft.AspNetCore.Authentication.AuthenticationService.ForbidAsync(HttpContext context, String scheme, AuthenticationProperties properties)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)
   at Swashbuckle.AspNetCore.SwaggerUI.SwaggerUIMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.Swagger.SwaggerMiddleware.Invoke(HttpContext httpContext, ISwaggerProvider swaggerProvider)
   at Microsoft.AspNetCore.Server.IIS.Core.IISHttpContextOfT`1.ProcessRequestAsync()

Can anyone here help me out?

[wanjuntham]

Ah I think I found it, I need to do return context.Response.WriteAsync("invalid scope");
But I dont understand the theory behind this, why do i need to write this async statement for the return?